V. INSTALLING ZIMBRA
Estimated Time : 10 minutes

Minimal server appliance has all required package for installing Zimbra. Postfix and all other applications that could potentially conflict with Zimbra package deactivated automatically on initial boot. You do not need to install additional package because all necessary package is bundled inside the appliance.

1. Go to folder /opt, download Zimbra binary installer from  Zimbra Website (At this writing, zimbra latest version is version 7.1.3), uncompress and then run the setup installer

   cd /opt
   wget -c http://files.zimbra.com/downloads/7.1.3_GA/zcs-7.1.3_GA_3346.SLES11_64.20110930001521.tgz
   tar -zxvf zcs-7.1.3_GA_3346.SLES11_64.20110930001521.tgz
   cd zcs-7.1.3_GA_3346.SLES11_64.20110930001521
   ./setup.sh
   

   `
   

2. Answer the question “Do you agree with the terms of the software license agreement? [N]“ with Y. Off course, because if you answer N, the installation process will simply stopped successfully
3. Press ENTER for all installation package. The default answer is Y. Leave the “zimbra-memcached” and “zimbra-proxy” as is (will not be install) because zimbra-memcached and zimbra-proxy only required for multi server installation.
   `
   
4. Zimbra will install the required application package and at the end will be check DNS records. On the DNS confirmation : “DNS ERROR resolving MX for mail.vavai.net
   It is suggested that the domain name have an MX record configured in DNS
   Change domain name? [Yes]“. Just answer “Y” for change domain and then typing your domain name (in my case : vavai.net) instead of your hostname (mail.vavai.net)
   `
   
5. Press 3  on the question “Address unconfigured (**) items  (? – help)” and press 4 on the question “Select, or ‘r’ for previous menu [r]“ to change the default password for Zimbra Admin
6. Fill in Zimbra Admin password. Note : Password will be displayed on plain text
7. Press ENTER on question “Select, or ‘r’ for previous menu [r]“
8. Press A on question “*** CONFIGURATION COMPLETE – press ‘a’ to apply
   Select from menu, or press ‘a’ to apply config (? – help)” and then press ENTER twice, following with “Y” and then  press ENTER on question “The system will be modified – continue? [No]“
   `
   
9. Zimbra will perform the system installation process. Please be patient . The installation will took 5-10 minutes depending your server performance (processor and memory)
10. Zimbra Open Source Edition will asking an optional registering your installation for statistics purpose only. Answer for this question are up to you

    You have the option of notifying Zimbra of your installation.
    This helps us to track the uptake of the Zimbra Collaboration Suite.
    The only information that will be transmitted is:
    The VERSION of zcs installed (7.1.3_GA_3346_SLES11_64)
    The ADMIN EMAIL ADDRESS created (admin@vavai.net)Notify Zimbra of your installation? [Yes]
    

11. Installation is complete, run the command :

    su - zimbra
    zmcontrol -v
    zmcontrol status
    

    `
    

12. Open the browser and go to http://your-zimbra-server-ip (in my case : http://192.168.1.250) or http://zimbra-hostname (in my case : http://mail.vavai.net) to access Zimbra Webmail
    `
    
13. Zimbra management can be done using the web admin with https protocol and default port 7071 : https://192.168.1.250:7071 or https://mail.vavai.net:7071

VI. SUMMARY

Zimbra Installation is very easy and requires a short time if we use the right tools. It can be done by using an appliance to simplify the installation process because I’ve prepare all the Zimbra requirement packages to the appliance and remove unnecessary application.

Hopefully this is useful for anyone who needs it. Warm regards from Jakarta-Indonesia

Note : I’m using YaST for openSUSE screenshot because I already have it. However, there should no significant difference between a screenshot with YAST configuration on SLES

IV. CONFIGURING LOCAL DNS SERVER

Estimated time : 3 minutes

Zimbra need an A & MX records that pointing to it’s IP Address. We could use/modify existing DNS records to meet with our requirement but I would prefer to installing local DNS server for it’s flexibility. If you’re currently using an existing & running mail server and need to replace it with Zimbra, you should not change any MX entry before completing and testing the configuration. Incomplete configuration on production mail server may impact to bounce mail, so, we need a local DNS server to prevent the impact and to do a full test before activating mail server for production use.

Setting up a DNS server on openSUSE for Zimbra requirement should be easy by using YAST. Below is a step by step, please change the IP and host name to meet with your environment on previous tutorial.

1. Type : yast dns-server on the console/terminal
2. Click Next on first configuration wizard : Forwarder List
   

   DNS Server wizard : Initial Windows

3. Add a new Zone. Typing your domain name on Zone name, choose Masteron type of zone and then click Add (ALT+A)
   

   Add DNS Zone

4. Press ALT+I (Edit) to modify your zone
   `
   
5. Just leave the first tab (Basics) as is. Press ALT+D to move to the second tab : NS Records
6. Write ns1 on Name Server to Add option and then press ALT+A to add the records. YAST will be smart enough to autocompleting the entry and give a fully qualified domain name to the records
   `
   
7. Press ALT+X to move to the third tab, MX Records. Fill in mail as Zimbra host name (see your configuration on first tutorial) on Address option, Give it a priority number (lower means highest priority) and then Press ALT+A to add MX records. Again, YAST will be smart enough to autocompleting the entry and give a fully qualified domain name to the MX records
   `
   
8. Leave the fourth tab as is, except you need to modify to SOA option
9. Move to final tab. Type : ns1 on Record key, choose A (Address Records) as records type and write Zimbra IP on records value and then press ALT+A to Add the records. Still on the final tab (Records), create the second Address Records for Zimbra hostname. Type mail on Record key, choose A (Address Records) as records type and write Zimbra IP on records value and then press ALT+A to add the mail Address Records
   `
   
10. Press ALT+O (OK)
11. Press ALT+N to go to the next wizard
12. Press ALT+S to Choose On : Start up now and When Booting and then press ALT+F  to completing DNS configuration. This will ensure that DNS service will be active on start up
    `
    
13. Restarting DNS Service by running the command : service named restart on console/terminal
14. Testing the DNS records using dig and nslookup : nslookup ns1.domain.tld and nslookup mail.domain.tld. if the setting is done correctly, DNS Server will respond with the Zimbra IP.
    `
    
    `
    
15. Here is my DNS server configurations that can be accessed on the file /var/lib/named/master/vavai.net
    `
    

Continue to the third part : Installing Zimbra Mail Server on SLES 11 SP1 64 bit in less than 30 Minutes-Part 3

1. WARNING : This guide using Preload ISO and will erase the entire contents of hard disk!  If you do not want to delete your existing data, consider using Virtualization server or use ISO-LiveCD.
2. Zimbra server will be using a private IP which will be translated into public IP using NAT
3. Zimbra will be setting up using Split-DNS concept. This means that in the internal network, mail server will be recognized based on a private IP network, while from the outside will be recognized based on the public IP. For this purpose, the internal DNS will be set up in Zimbra Mail Server
4. Zimbra Fully Qualified Domain Name : mail.vavai.net, private IP : 192.168.1.250

I. DOWNLOAD MINIMAL SERVER

Imapsync is one very useful tool because it can be used to perform backup and synchronization of all email content, both structure and content. For example, if we have an inbox, sent items, drafts, trash, etc in the old mail server, we can copy the structure and content seamlessly into the new mail server. Imapsync even able to backup a folder other than the default folder, such as copying a folder called “Vavai” and “Urgent”, etc inside my inbox folder.

The following tutorial is the process of installation and usage of Imapsync on SUSE Linux Enterprise Server 11 SP 1, although Imapsync can be run in almost all Linux systems.

INSTALLATION

Run the following command via the console / terminal:

zypper ar http://download.opensuse.org/repositories/devel:/languages:/perl/SLE_11 perl
http://download.opensuse.org/repositories/home:/pheinlein/SLE_11_SP1/ imapsync
zypper ref
zypper in imapsync perl-Date-Manip perl-Mail-IMAPClient

Note : I’m using package on openSUSE Build Services to install Imapsync. Do not forget to change the version and type of openSUSE distribution in accordance with your running system.

USAGE

Here is an example of using Imapsync to synchronize a mailbox from the mail server with an IP 192.168.10.2 to the mail server with an IP 192.168.10.1 (Imapsync can also use server hostname instead of ip address):

imapsync - host1 192.168.10.2 - user1 budi@namadomain.com - passwordbudi password1 - host2 192.168.10.1 - vavai@namadomain.co.id user2 - password2 passwordvavai - noauthmd5 -ssl1 -ssl2

The above command will copy the mailbox budi@namadomain.com on server 192.168.10.2 to the mailbox vavai@namadomain.co.id on server 192.168.10.1.

Let’s see the user account between primary server and secondary server. As you may notices, Imapsync can be used to copy the email user A to the same mailbox on another server or to a different mailbox on another server

NOTE:

1. - – follows by words are Imapsync parameters. –user1 budi@namadomain.com means that user account in first server is budi@namadomain.com
2. Imapsync can be used to synchronize all mail server that supports the IMAP protocol (as the name implies, Imapsync, not POPsync especially lipsync ), so it can be used on Postfix+Imap, Sendmail + Imap, Qmail+Imap, MDaemon, Microsoft Exchange etc
3. Imapsync requires a password for each account to be successfully synchronized.
4. Imapsync is able to synchronize the password if we know both accounts and password. We have to equate all the passwords if you want to easily synchronize with the command above. Oon some mail servers, we can use Imapsync with the – -authuser to access user mailboxes by using admin privileges.

Below are a simple script to bulk-reset Zimbra account password :

#!/bin/bash
clear
USERS=`su - zimbra -c 'zmprov -l gaa'`;

for ACCOUNT in $USERS; do
ACC1=`echo $ACCOUNT | awk -F@ '{print $1}'`;
ACC=`echo $ACC1 | cut -d '.' -f1`;

if [ $ACC == "admin" ] || [ $ACC == "wiki" ] || [ $ACC == "galsync" ] || [ $ACC == "ham" ] || [ $ACC == "spam" ]; then
echo "Skipping system account, $NAME...";
else
echo "Modifying $ACCOUNT password...";
su - zimbra -c "zmprov sp $ACCOUNT NewGeneratedPassword";
su - zimbra -c "zmprov ma $ACCOUNT zimbraPasswordMustChange TRUE;
echo "Done!"
echo ""
# read anykey
fi
done
echo "Modifying password for all user has been finished successfully"

Note : I think it would be better to include some personal ID (part of user name or any fields) into generated-password so all password will be a semi-random password. In my case, I’m using user birth date or part of their name for their generated password to prevent anyone trying to login to any mailbox. It’s not really secure but in my case, it was sufficient for temporary purpose.

At first, installing server is an interesting jobs but after similar works on some client, I feel bored with the process, ie :

1. Virtualization Server (VMWare, KVM, OpenVZ, Xen, etc) Installation
2. Server OS installation
3. Application Installation
4. Customizing the configuration

I think I could reduce the time for processing the above task by making an appliance using SUSE Studio. An appliance will contains my default server setup and all of packages required by application. The results are Minimal Server Appliance.

Minimal Server Appliance based on SUSE Linux Enterprise Server 11 SP1 64 bit Just Enough Operating System (JeOS). It has all minimal server package with DRBD+Heartbeat from High Availability Extension (HAE) Addons.

The Appliance was successfully tested to running Zimbra Collaboration Suite 7.×.x (latest testing with Zimbra 7.1.3) on VMWare ESXi, Proxmox VE, VirtualBox and KVM Virtualization. Use the following user name and password credentials to make modification to the appliance configuration :

User Name : root
Password : opensuse

By using this application I can reduce the installation time to just a few minutes only. If you wish to make some modification, feel free to clone the appliance and making your own.

Notes from latest releases :

001 : Change Appliance Size to 50 GB (Dynamic Size)
002 : Add netcat package, required by Zimbra zmconfigd
003 : Add Indonesian Local Mirror for SLES 11 SP1 64 bit
004 : Add imapsync package for mail migration and synchronization
005 : Add nmap package for port tracking
006 : Add opendkim package for Zimbra DKIM signature
007 : Add ntp and yast2-ntp-client for time synchronization
008 : Add sqlite3 package, required by Zimbra 7.×.x

I’m intended and mostly using the appliance for Zimbra mail server deployment on top of SLES 11 SP1 64 bit but the appliance itself could be setting up as web server, database server, proxy server, file server, etc.

Minimal Server Appliance available on ISO LiveCD, Preload ISO for physical server deployment and Virtual Image (OVF and VMX extension) for virtual server deployment.

Please let me know if you found any bugs regarding the appliance.

Below are step-by-step how to install RapidSSL certificate on Zimbra Mail Server

1. Open Zimbra Administration Console, go to Tools | Certificate menu and then click on Install Certificate link
2. Follow the Certificate creation wizard. On Second wizard windows, choose Generate the CSR for the commercial certificate authorizer options and then click on Next button until final wizard windows. Don’t forget to fill in an appropriate entry to the certificate fields.
3. 
4. On final wizard, click on Download the CSR link
5. Buy an SSL certificate from RapidSSL and use the downloaded CSR on the above process as required by RapidSSL. RapidSSL will send us the webserver and intermediate certificate
6. Create a blank-text file /tmp/zcsserver.crt. Copy-paste all of webserver certificate content from RapidSSL including Begin Certificate and End Certificate line into /tmp/zcsserver.crt.
7. Run the following command :

   cd /tmp
   wget http://www.geotrust.com/resources/root_certificates/certificates/GeoTrust_Global_CA.cer
   wget https://knowledge.rapidssl.com/library/VERISIGN/ALL_OTHER/RapidSSL%20Intermediate/RapidSSL_CA_bundle.pem
   cat GeoTrust_Global_CA.cer RapidSSL_CA_bundle.pem > /tmp/ca_bundle.crt
   cd /opt/zimbra/bin
   ./zmcertmgr deploycrt comm /tmp/zcsserver.crt /tmp/ca_bundle.crt
   chmod 644 /opt/zimbra/java/jre/lib/security/cacerts
   /opt/zimbra/java/bin/keytool -import -alias rapidsslintca -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit -file /tmp/RapidSSL_CA_bundle.pem
   su - zimbra
   zmcontrol restart
   

   changeit on the above line is the default password for Mailbox truststore. If you wish to verify the correct password, check it with the following command :

   su - zimbra
   zmlocalconfig -s | grep mailboxd_truststore_password
   

8. Check your Zimbra Mail Server with https protocol and make sure that certificate was installed sucessfully

Note : If you wish to replace the words Which is run by (unknown) to an appropriate organization name, buy the premium or advanced SSL certificate. Premium or Advanced SSL certificate is more expensive than standard SSL certificate and need a document from your organization to be verified by SSL certificate provider

Does the upgrade process should be applied for production use ? The answer depends on your environment. If an existing system quite stable with minor problem, you may stick with your existing Zimbra system but if you need some features that only provided by Zimbra 7, upgrading may be the best option. I’m currently manages some Zimbra for production mail server system on some client, most of them are corporate with user 100-10k users.

If you wish to upgrading  Zimbra 6.x.x into Zimbra 7.x.x, below are some notes to make upgrading process works successfully. Upgrade process took about 30 minutes on system with 8 GB of RAM

1. Full Backup. Backup is a must, especially for major upgrade from Zimbra 6 to Zimbra 7. Backup all your  /opt/zimbra to a backup media. It’s a preventive tasks, as an emergency option in case upgrade process doesn’t work as expected.
2. Write a Notes for Custom Modification. Upgrading process will remove all custom modification to Zimbra system, including DomainKeys/DKIM, PolicyD, Postfix Restrict Recipient, RBL override, custome Postfix tweaks, etc
3. Download & Read Release Notes Carefully. Release notes can be obtained from  : http://www.zimbra.com/downloads/os-downloads.html. Read it carefully, especially for pre, on and post install tips.
4. Update MySQL Database. Zimbra bypassing this process because this process will took a much longer time, depending MySQL database size. Although the bypass process will not messed up email sending and receiving,  Zimbra will issued an error for  database integrity report as below :

   Database errors found.
   /opt/zimbra/mysql/bin/mysqlcheck --defaults-file=/opt/zimbra/conf/my.cnf -S /opt/zimbra/db/mysql.sock -A -C -s -u root --password=XtfabvSktqwZBQKFU5J.vAJ8QQUpssqi
   mboxgroup1.appointment
    error    : Table upgrade required. Please do "REPAIR TABLE `appointment`" or dump/reload to fix it!
    mboxgroup1.data_source_item
    error    : Table upgrade required. Please do "REPAIR TABLE `data_source_item`" or dump/reload to fix it!
    mboxgroup1.imap_folder
    error    : Table upgrade required. Please do "REPAIR TABLE `imap_folder`" or dump/reload to fix it!
    mboxgroup1.mail_item
    error    : Table upgrade required. Please do "REPAIR TABLE `mail_item`" or dump/reload to fix it!
    mboxgroup1.pop3_message
    error    : Table upgrade required. Please do "REPAIR TABLE `pop3_message`" or dump/reload to fix it!

   To resolve this problem, run following command from konsole/terminal :

   /opt/zimbra/libexec/scripts/migrate20100913-Mysql51.pl

   The above command will invoke Zimbra to updating  MySQL database from Zimbra 6.x.x database schema

5. Optional : Authorizing Zimbra MTA. If your Zimbra server could not send an email after upgrade, run the following command :

   sudo /opt/zimbra/bin/zmprov –m –l yourZimbra.server.com zimbraMtaAuthHost yourZimbra.server.com

   Note : the above command are optional, you do not need to execute the command if your Zimbra server doesn’t have any problem for sending and receiving email.

Fully tested upgrading Zimbra 6.0.10 to Zimbra 7.1.0 on SUSE Linux Enterprise Server 11 SP1 64 bit.

DKIM originally written as sender authentication protocol developed in order to address the problem of forged email messages. Yahoo! released the DomainKeys specification and Cisco released the Internet Identified Mail specification. Both methods are based on cryptographic message signing. The two efforts have been merged, and the combined specification is known as DomainKeys Identified Mail (DKIM).

These are various options for implementing DomainKeys Signature : by using DK-Filter, DKIM-milter, OpenDKIM and also by using Amavisd-new DKIM implementation. Don’t be confused with all the terms. All method have similar function, signing your email as “trusted” or legitimate email.

Implementing OpenDKIM on openSUSE/SLES  for Zimbra Mail Server can be achieved with 5 easy steps :

1. Installing OpenDKIM
2. Configuring OpenDKIM
3. Configuring DNS Records
4. Integrating with Your Mail Server (in my case : Zimbra Mail Server)
5. Testing & Verified DKIM Signature

OPENDKIM INSTALLATION

Download and install OpenDKIM. I found a repo on openSUSE Build Services Repository,  Webpin. RPM has build for openSUSE 11.2 but you may also install it on openSUSE 11.3 or SLES 11.

In case the original RPM removed from repos, I make a backup copy on my repo http://download.vavai.com.

wget -c http://download.vavai.com/repo/x86_64/opendkim-2.2.2-2.1.x86_64.rpm
wget -c http://download.vavai.com/repo/x86_64/libopendkim3-2.2.2-2.1.x86_64.rpm
zypper in *.rpm

OPENDKIM CONFIGURATION

1. Create OpenDKIM configuration

   cp /usr/share/doc/packages/opendkim/opendkim.conf.sample /etc/opendkim.conf
   mkdir -p /etc/mail/dkim

2. Modify  /etc/opendkim.confto meet with your environment

   BaseDirectory /var/run/opendkim
   Domain vavai.web.id
   InternalHosts 192.168.10.0/24, 127.0.0.1
   KeyFile /etc/mail/dkim/selector.private
   Mode sv
   Selector selector
   Socket inet:8891@localhost
   Syslog Yes
   SyslogFacility mail
   X-Header Yes

3. Create selector and key for signing message

   opendkim-genkey -d vavai.web.id -D /etc/mail/dkim -s selector
   cd /etc/mail/dkim
   chmod 440 selector.private

   The above command made  2 files : selector.txt &selector.private. selector.txt contain DNS records that we must insert into our DNS Server .

4. Run openDKIM with following command :

   opendkim -x /etc/opendkim.conf

DNS SERVER CONFIGURATION

Open /etc/mail/dkim/selector.txt and copy it’s content into our DNS Server. If your public DNS managed by ISP, contact and ask them for inserting a TXT records into DNS Server for our domain.

Below are a sample of my DNS Server for domain vavai.web.id :

# cat /var/lib/named/master/vavai.web.id
$TTL 2d
@		IN SOA		ns1.vavai.web.id.	root.ns1.vavai.web.id. (
				2010122101	; serial
				3h		; refresh
				1h		; retry
				1w		; expiry
				1d )		; minimum
 
vavai.web.id.	IN NS		ns1.vavai.web.id.
vavai.web.id.	IN NS		ns2.vavai.web.id.
vavai.web.id.   IN A		174.120.9.XXX
vavai.web.id.	IN MX		0 mail.vavai.web.id.
www		IN CNAME	vavai.web.id.
ns1		IN A		202.158.52.xxx
mail		IN A		202.158.52.xxx
ns2		IN A		202.43.115.xxx
vavai.web.id.   IN TXT          "v=spf1 a mx include:mail.vavai.web.id ~all"
selector._domainkey IN TXT "v=DKIM1; r=postmaster; g=*; k=rsa; p=MIG29fMA0GCSqsdfsdfdsfdsfGSIb3DQEBAQUAA4GNADCBiQKBgQDJ5IZT5e5nvmkotroz5ylTlwU8yEEZ+v/576aI+w6TkbP4XibYxDsWVweXXtVeQQMMAAmw8AwYuK5R9b373Xqu+Hv9HNAJoAteKF/qlKcZc5Akhj5B7P1imXaurZkkIBp63yBZyZRralzQYNT3UrVB7M/xONMWXcU9xm7Zv1PzH1Y1OQIDAQAB"

ZIMBRA MAIL SERVER CONFIGURATION

Login as Zimbra user (su – zimbra) and then add the following item :

    -o milter_default_action=accept
    -o smtpd_milters=inet:localhost:8891
    -o non_smtpd_milters=inet:localhost:8891
    -o disable_mime_output_conversion=yes

into bottom line of /opt/zimbra/postfix/conf/master.cf.in, after the following line :

-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_address_mappin

TESTING & VERIFYING OPENDKIM
After all step has been successfully executed, testing OpenDKIM by sending a blank email into sa-test@sendmail.net or check-auth@verifier.port25.com or autorespond+dkim@dk.elandsys.com or into your Gmail/Yahoo email account.

Below are a sample of response message from sendmail :

Authentication System:       DomainKeys Identified Mail
Result:                   DKIM signature confirmed GOOD
Description:              Signature verified, message arrived intact
Reporting host:           sendmail.net
More information:         http://mipassoc.org/dkim/
Sendmail milter:          https://sourceforge.net/projects/dkim-milter/

Respon from elandsys :

This is an automatic response.  Replies to this message will not generate
an automatic response.
Do not reply to this message except for reporting a problem.
 
The results are as follows:
 
DKIM Signature validation: pass (1024-bit key)

Response from Gmail

Received-SPF: pass (google.com: domain of vavai@vavai.web.id designates XXX.158.52.XXX as permitted sender) client-ip=XXX.158.52.XXX;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of vavai@vavai.web.id designates XXX.158.52.XXX as permitted sender) smtp.mail=vavai@vavai.web.id; dkim=pass header.i=@vavai.web.id
Received: from localhost (localhost [127.0.0.1])
	by mx3.vavai.web.id (Postfix) with ESMTP id 0E666DB0302
	for ; Wed, 22 Dec 2010 09:42:12 +0700 (WIT)
X-Virus-Scanned: amavisd-new at vavai.web.id
Received: from mx3.vavai.web.id ([127.0.0.1])
	by localhost (mx3.vavai.web.id [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id On3P3QqkyMM4 for ;
	Wed, 22 Dec 2010 09:42:11 +0700 (WIT)
Received: from mx3.vavai.web.id (mx3.vavai.web.id [XXX.158.52.XXX])
	by mx3.vavai.web.id (Postfix) with ESMTP id 56CC1DB0136
	for ; Wed, 22 Dec 2010 09:42:11 +0700 (WIT)
X-DKIM: OpenDKIM Filter v2.2.2 mx3.vavai.web.id 56CC1DB0136
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=vavai.web.id;
	s=selector; t=1292985731;
	bh=cBOiyKgb7kh/ygTXq8sQihgwMCryqYRvRZBYcO6/z5U=;
	h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;
	b=KMOYjsda6qPqNdf0NuyxdEayFxgRCAVmilYKobK3sKV8hSvybT3fmbWM+2mZUCzMY
	 sDSdVVTXMB6RnHoEPyPzNFK7y9TPpAn0SPkGqL0nSzQ+Fr6/VaEBHrcQGduUNm5Ot5
	 V0Y9vIcmfjLGWTkkAX0RjHpV/9ZK8VPJD0etRsM0=

Zimbra save all account and profile information on the LDAP database. Zimbra has no function for only import and export it’s account, although they have bundled Zimbra to Zimbra migration command. The Zimbra to Zimbra migration command export all mailbox and account while I only need a list of account with some primary fields like password, first name, full name, etc, especially for testing purpose only.

I decided to create a simple script that look for related information on Zimbra LDAP with the following algorithm :

1. Check  Zimbra version, because Zimbra 5 and Zimbra 6 has different method for accessing LDAP and also these are a few changes on Zimbra CLI. Zimbra 6 need paramater for command while Zimbra 5 doesn’t need it, e.g, on Zimbra 5, running zmprov gaa will list all Zimbra account but on Zimbra 6 we must use zmprov -l gaa to display same result.
2. Export all account profile to temporary parameter and loop for all account
3. Skip all system account : admin, ham, spam, galsync and wiki. All these system account doesn’t need to be exported because Zimbra will create all system account on installation process.
4. Get all account identity/fields from Zimbra LDAP by using  LDAPsearch command
5. Create a text file with zmp extension. This file will contains  zmprov ca command with proper parameter from step 4
6. Create ldif file for updating Zimbra LDAP password, because Zimbra LDAP using SSHA encryption and the better method for updating Zimbra LDAP password is using ldapmodify command.
7. Finish

Algorithm for Import Account

1. Check whether user are already on Zimbra user environment or not
2. Check is there existing  zmp and ldif file (the result from export script)
3. Import zmp file
4. Run ldapmodify command to change Zimbra LDAP password by using  ldif data
5. Finish

Please remember that you must running export  script by using root privilege  but the  import account must be run within  Zimbra user environment (su – zimbra).

Look at following example to run Zimbra Account export script :

su
cd /srv
wget -c http://vavai.com/wp-content/uploads/exim-acc-zcs.tar.gz
tar -zxvf exim-acc-zcs.tar.gz
cd exim-acc-zcs
./export-acc-zcs.sh

The above command will produce  zcs-acc-add.zmp and zcs-acc-mod.ldif file. Copy all four file (the last two are  script file) onto some folder on target server and run the following command to import the account and it’s profile :

su
su - zimbra
cd /home/vavai
./import-acc-zcs.sh

Script has been sucessfully tested on Zimbra 6.0.5, 6.0.6 dan 6.0.7 on SUSE Linux Enterprise Server 11 and openSUSE 11.

Download Zimbra Account Export-Import Script by click on the download icon belows :

Script for export :

#!/bin/sh

#Hapus Layar
clear

echo -e "###################################################################################"
echo -e "# Zimbra export-acc-zcs.sh ver 0.0.2                                              #"
echo -e "# Skrip untuk export account Zimbra berikut profile dan password                  #"
echo -e "# Masim 'Vavai' Sugianto - vavai@vavai.com - http://www.vavai.com                 #"
echo -e "# Untuk saran dan pertanyaan silakan menggunakan Milis Komunitas Zimbra Indonesia #"
echo -e "# Link Komunitas : http://www.zimbra.web.id - http://www.opensuse.or.id           #"
echo -e "###################################################################################"

# /* Variable untuk bold */
ibold="\033[1m""\n===> "
ebold="\033[0m"

# /* Parameter */
echo ""
echo -n "Enter Domain Name (ex : vavai.com) : "
read NAMA_DOMAIN
echo -n "Enter path folder for exported account (ex : /home/vavai/) : "
read FOLDER

# /* Membuat file hasil export dan mengisi nama domain */
NAMA_FILE="$FOLDER/zcs-acc-add.zmp"
LDIF_FILE="$FOLDER/zcs-acc-mod.ldif"

rm -f $NAMA_FILE
rm -f $LDIF_FILE

touch $NAMA_FILE
touch $LDIF_FILE

echo "createDomain $NAMA_DOMAIN" > $NAMA_FILE

# /* Check versi Zimbra yang digunakan */
VERSION=`su - zimbra -c 'zmcontrol -v'`;
ZCS_VER="/tmp/zcsver.txt"
# get Zimbra LDAP password
ZIMBRA_LDAP_PASSWORD=`su - zimbra -c "zmlocalconfig -s zimbra_ldap_password | cut -d ' ' -f3"`

touch $ZCS_VER
echo $VERSION > $ZCS_VER

echo -e $ibold"Retrieve Zimbra User.............................."$ebold

grep "Release 5." $ZCS_VER
if [ $? = 0 ]; then
USERS=`su - zimbra -c 'zmprov gaa'`;
LDAP_MASTER_URL=`su - zimbra -c "zmlocalconfig -s ldap_master_url | cut -d ' ' -f3"`
fi

grep "Release 6." $ZCS_VER
if [ $? = 0 ]; then
USERS=`su - zimbra -c 'zmprov -l gaa'`;
LDAP_MASTER_URL="ldapi:///"
fi

echo -e $ibold"Processing account, please wait.............................."$ebold
# /* Proses insert account kedalam file hasil export */
for ACCOUNT in $USERS; do
NAME=`echo $ACCOUNT`;
DOMAIN=`echo $ACCOUNT | awk -F@ '{print $2}'`;
ACCOUNT=`echo $ACCOUNT | awk -F@ '{print $1}'`;
ACC=`echo $ACCOUNT | cut -d '.' -f1`

if [ $NAMA_DOMAIN == $DOMAIN ] ;
then
OBJECT="(&(objectClass=zimbraAccount)(mail=$NAME))"
dn=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep dn:`

displayName=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep displayName: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`

givenName=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep givenName: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`

userPassword=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep userPassword: | cut -d ':' -f3 | sed 's/^ *//g' | sed 's/ *$//g'`

cn=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep cn: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`

initials=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep initials: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`

sn=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep sn: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`

if [ $ACC == "admin" ] || [ $ACC == "wiki" ] || [ $ACC == "galsync" ] || [ $ACC == "ham" ] || [ $ACC == "spam" ]; then
echo "Skipping system account, $NAME..."
else
echo "createAccount $NAME passwordtemp displayName '$displayName' givenName '$givenName' sn '$sn' initials '$initials' zimbraPasswordMustChange FALSE" >> $NAMA_FILE

echo "$dn
changetype: modify
replace: userPassword
userPassword:: $userPassword
" >> $LDIF_FILE
echo "Adding account $NAME"
fi
else
echo "Skipping account $NAME"
fi

done
echo -e $ibold"All account has been exported sucessfully into $NAMA_FILE and $LDIF_FILE..."$ebold

Script for import :

#!/bin/sh

#Hapus Layar
clear

echo -e '###################################################################################'
echo -e '# Zimbra import-zcs-acc.sh ver 0.0.1                                              #'
echo -e '# Skrip untuk import data account Zimbra                                          #'
echo -e '# Masim 'Vavai' Sugianto - vavai@vavai.com - http://www.vavai.com                 #'
echo -e '# Untuk saran dan pertanyaan silakan menggunakan Milis Komunitas Zimbra Indonesia #'
echo -e '# Link Komunitas : http://www.zimbra.web.id - http://www.opensuse.or.id           #'
echo -e '###################################################################################'

# /* Variable untuk bold */
ibold="\033[1m""\n===> "
ebold="\033[0m"

if [ "$USER" != "zimbra" ]
then
echo -e $ibold"You need to be user zimbra to run this script..."$ebold
exit
fi

CURRENT_FOLDER=`pwd`;

echo ""
echo -e "Please verify that you have copied zcs-acc-add.zmp & zcs-acc-mod.ldif on current folder !"
echo -e "Current Folder : $CURRENT_FOLDER, Please change to your folder before running this script."
echo -e "Press ENTER to continue..."
read jawab

if [ -f ./zcs-acc-add.zmp ];
then
if [ -f ./zcs-acc-add.zmp ];
then
echo -e $ibold"Importing account..."$ebold

ZIMBRA_LDAP_PASSWORD=`zmlocalconfig -s zimbra_ldap_password | cut -d ' ' -f3`

#		cat ./zcs-acc-add.zmp | su - zimbra -c zmprov
zmprov < $CURRENT_FOLDER/zcs-acc-add.zmp

echo -e $ibold"Modify password..."$ebold

ldapmodify -f "$CURRENT_FOLDER/zcs-acc-mod.ldif" -x -H ldapi:/// -D cn=config -w $ZIMBRA_LDAP_PASSWORD

#		su - zimbra -c '$LDAP_CMD'

echo -e $ibold"Zimbra account has been modified sucessfully ..."$ebold

else
echo "Sorry, file $CURRENT_FOLDER/zcs-acc-mod.ldif does not exists, import process will not be continue..."
exit
fi
else
echo "Sorry, file $CURRENT_FOLDER/zcs-acc-add.zmp does not exists, import process will not be continue..."
exit
fi