The Perfect Server - Debian Squeeze (Debian 6.0) With BIND & Courier [ISPConfig 3] - Page 5

17 Install fail2ban

This is optional but recommended, because the ISPConfig monitor tries to show the log:

apt-get install fail2ban

To make fail2ban monitor PureFTPd, SASL, and Courier, create the file /etc/fail2ban/jail.local:

vi /etc/fail2ban/jail.local

[pureftpd]

enabled  = true
port     = ftp
filter   = pureftpd
logpath  = /var/log/syslog
maxretry = 3


[sasl]

enabled  = true
port     = smtp
filter   = sasl
logpath  = /var/log/mail.log
maxretry = 5


[courierpop3]

enabled  = true
port     = pop3
filter   = courierpop3
logpath  = /var/log/mail.log
maxretry = 5


[courierpop3s]

enabled  = true
port     = pop3s
filter   = courierpop3s
logpath  = /var/log/mail.log
maxretry = 5


[courierimap]

enabled  = true
port     = imap2
filter   = courierimap
logpath  = /var/log/mail.log
maxretry = 5


[courierimaps]

enabled  = true
port     = imaps
filter   = courierimaps
logpath  = /var/log/mail.log
maxretry = 5

Then create the following five filter files:

vi /etc/fail2ban/filter.d/pureftpd.conf

[Definition]
failregex = .*pure-ftpd: \(.*@<HOST>\) \[WARNING\] Authentication failed for user.*
ignoreregex =

vi /etc/fail2ban/filter.d/courierpop3.conf

# Fail2Ban configuration file
#
# $Revision: 100 $
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#
failregex = pop3d: LOGIN FAILED.*ip=\[.*:<HOST>\]

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

vi /etc/fail2ban/filter.d/courierpop3s.conf

# Fail2Ban configuration file
#
# $Revision: 100 $
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#
failregex = pop3d-ssl: LOGIN FAILED.*ip=\[.*:<HOST>\]

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

vi /etc/fail2ban/filter.d/courierimap.conf

# Fail2Ban configuration file
#
# $Revision: 100 $
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#
failregex = imapd: LOGIN FAILED.*ip=\[.*:<HOST>\]

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

vi /etc/fail2ban/filter.d/courierimaps.conf

# Fail2Ban configuration file
#
# $Revision: 100 $
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#
failregex = imapd-ssl: LOGIN FAILED.*ip=\[.*:<HOST>\]

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

Restart fail2ban afterwards:

/etc/init.d/fail2ban restart

 

18 Install SquirrelMail

To install the SquirrelMail webmail client, run

apt-get install squirrelmail

Then create the following symlink...

ln -s /usr/share/squirrelmail/ /var/www/webmail

... and configure SquirrelMail:

squirrelmail-configure

We must tell SquirrelMail that we are using Courier-IMAP/-POP3:

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color on
S   Save data
Q   Quit

Command >>
 <-- D


SquirrelMail Configuration : Read: config.php
---------------------------------------------------------
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don't work so
well with others.  If you select your IMAP server, this option will
set some pre-defined settings for that server.

Please note that you will still need to go through and make sure
everything is correct.  This does not change everything.  There are
only a few settings that this will change.

Please select your IMAP server:
    bincimap    = Binc IMAP server
    courier     = Courier IMAP server
    cyrus       = Cyrus IMAP server
    dovecot     = Dovecot Secure IMAP server
    exchange    = Microsoft Exchange IMAP server
    hmailserver = hMailServer
    macosx      = Mac OS X Mailserver
    mercury32   = Mercury/32
    uw          = University of Washington's IMAP server
    gmail       = IMAP access to Google mail (Gmail) accounts

    quit        = Do not change anything
Command >>
 <-- courier


SquirrelMail Configuration : Read: config.php
---------------------------------------------------------
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don't work so
well with others.  If you select your IMAP server, this option will
set some pre-defined settings for that server.

Please note that you will still need to go through and make sure
everything is correct.  This does not change everything.  There are
only a few settings that this will change.

Please select your IMAP server:
    bincimap    = Binc IMAP server
    courier     = Courier IMAP server
    cyrus       = Cyrus IMAP server
    dovecot     = Dovecot Secure IMAP server
    exchange    = Microsoft Exchange IMAP server
    hmailserver = hMailServer
    macosx      = Mac OS X Mailserver
    mercury32   = Mercury/32
    uw          = University of Washington's IMAP server
    gmail       = IMAP access to Google mail (Gmail) accounts

    quit        = Do not change anything
Command >> courier

              imap_server_type = courier
         default_folder_prefix = INBOX.
                  trash_folder = Trash
                   sent_folder = Sent
                  draft_folder = Drafts
            show_prefix_option = false
          default_sub_of_inbox = false
show_contain_subfolders_option = false
            optional_delimiter = .
                 delete_folder = true

Press any key to continue...
 <-- press a key


SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color on
S   Save data
Q   Quit

Command >>
 <-- S


SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color on
S   Save data
Q   Quit

Command >>
 <-- Q

Afterwards you can access SquirrelMail under http://server1.example.com/webmail or http://192.168.0.100/webmail:

Share this page:

34 Comment(s)

Add comment

Comments

From: at: 2011-02-13 16:59:43

With this configuration I am unable to fetchmail in ISPConfig due to not being able to resolve the the domain name of the external mailbox. If i turn off the firewall, dns works fine. If I open all ports > 1000 it works fine. I believe this has something to do with the return port of the dns query to my name server? Maybe iptables?

From: JeffryL at: 2011-03-26 17:21:25

Great tutorial but even better if it would also describe how to force ISP over a secure connection (https) which is not very hard to configure. E.g. this site describes one way, although enabling ssh is not necessary anymore after fulfilling this tutorial and ISP3 has some standard configuration lines that can be uncommented... (And why isn't ssl standard in ISP3?!?!)

http://www.faqforge.com/linux/controlpanels/ispconfig3/enable-ssl-for-the-ispconfig-3-controlpanel/

Second, and perhaps a bit more difficult is securing phpmyadmin. I think phpmyadmin as a 'folder' in a website is not very secure since you cannot easily force it to connect over ssl (or can you? Lemme know!) On my server I would prefer phpmyadmin only accessible over ssl.

From: Anonymous at: 2011-06-09 09:42:49

Isn't FAM necessary for Courier IMAP? Most mailclients seem to complain when it is not installed..

From: at: 2012-03-21 17:30:33

remember to apt-get update and apt-get upgrade before start 

apt-get install ssh openssh-server

packages change names ... like happen to me a few minutes a go ...  

From: Idrassi at: 2011-02-11 17:05:18

The following two commands must be run before quotacheck and quotaon :

touch /aquota.user /aquota.group
chmod 600 /aquota.*

From: JeffryL at: 2011-03-26 17:06:41

Not necessary anymore. Files are made automatically with the right permissions.

From: Pilgrim at: 2011-02-21 11:33:58

Hi...

Great tutorial,
but I have a small problem with postfix.
I'm using domain with NSSet to my server. Domain is a for example somestupiddomain.cz.
This domain is a NS domain for nameservers too like ns1.somestupiddomain.cz and ns2.somestupiddomain.cz.

Problem is a with Postfix main.cnf file with mydestination param.
The default settings is a:

mydestination = somestupiddomain.cz, localhost, localhost.localdomain

If I sent email to any mailbox on this domain, the email was not delivered and I delivered back to sender error: Undelivered Mail Returned to Sender - unknown user "test".

Anyother domains on this server are OK and theirs emails were successfully delivered.

I was change this mydestination param for fixing this problem to:

mydestination = assigned-XXX.XXX.XXX.XXX.provider.cz, localhost, localhost.localdomain

After this, all emails to somestupiddomain.cz were succesfully delivered.
The param mydestination must be a FQDN hostname of server.

 (sorry for my english) ;-)

From: Cody at: 2011-05-05 19:17:22

E: Unable to locate package libsas12-2
E: Unable to locate package libsas12-modules
E: Unable to locate package libsas12-modules-sql
E: Unable to locate package sas12-bin

and i can't continue from there because i need SQL to be installed

i'm a newby, how do i check if its been installed and if its running?

(up until here i followed your tutorial exactly [excluding hostname / domainname / username / repositories] and its worked!)

 

From: Anonymous at: 2011-05-20 21:54:08

It's not libsas1 but libsasl with the L not the 1

From: at: 2011-05-18 10:08:13

For the new version of the JailKit, change the following. This fixes the following:

Jailkit 2.14 fixes a infinite loop in jk_cp and jk_init if ldd output for some reason contains two slashes (//lib/libfoo.so). Furthermore, jk_chrootsh can now be called as 'su'

cd /tmp
wget http://olivier.sessink.nl/jailkit/jailkit-2.14.tar.gz
tar xvfz jailkit-2.14.tar.gz
cd jailkit-2.14
./debian/rules binary
cd ..
dpkg -i jailkit_2.14-1_*.deb
rm -rf jailkit-2.14*

From: Steboo at: 2011-05-27 14:22:36

Don´t forget to install the libfam0 or libgamin0 if you want to use the IMAP-Server.

 

From: lenz at: 2011-06-09 08:52:22

To prevent filesystem error like this:

"IMAP server information: Filesystem notification initialization error -- contact your mail administrator (check for configuration errors with the FAM/Gamin library)"

install gamin:

apt-get install gamin

(http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=599682 )

From: Ed at: 2011-09-19 19:17:55

Hello,

I can't get past step 10 - I receive an "Abort." on the terminal screen when I enter "Y" to continue with the installation of the packages.

This is a amd 64 bit system that came pre-configured with debian squeeze 64 bit for amd64, but with nothing else, I think.

Why would I receive that Abort by the system when trying to install the packages in step 10?

Thanks for any help - I am new with 64 bit debian and squeze.

 

Ed

From: Ed at: 2011-09-20 09:36:40

Hello,

I solved this problem by using aptitude instead of apt-get

IBM machine with Opteron 2218  squeeze amd64

From: at: 2011-10-24 20:43:16

Are you getting pthread errors? For example, it might complain that pthread is not found:

jk_socketd.c:(.text+0xa94): undefined reference to `pthread_create'

If so, try this solution:

LIBS=-pthread ./debian/rules binary

From: Anonymous at: 2012-01-06 22:31:39

When I try the following command (from the guide) I get an error:

 ./debian/rules binary

Error:

checking whether we are cross compiling... configure: error: in `/tmp/jailkit-2.13':
configure: error: cannot run C compiled programs.
If you meant to cross compile, use `--host'.
See `config.log' for more details.
make: *** [config.status] Error 1

 I have checked so "gcc is already the newest version." and libpq5 is installed.
Why cant my debian make this compilation?

From: bjarne at: 2012-02-28 16:25:14

By default the SSL certificates for IMAP and POP3 has a lifetime of 1 year. It is possible to change this by editing mkimapdcert and mkpop3dcert scripts directly:
 
vi /usr/sbin/mkimapdcert
vi /usr/sbin/mkpop3dcert

#look for line /usr/bin/openssl req -new -x509 -days 365 -nodes \

Remove the old certficates and run mkimapdcert and mkpop3dcert again

From: pallermo at: 2012-08-03 07:59:10

Hmm...I am getting this kind of message (error) when I try  "quotacheck -avugm"

 quotacheck: Cannot find filesystem to check or filesystem not mounted with quota option.

Eveything is ql but only this is the problem.  

 fstab is next:

proc /proc proc defaults 0 0

none /dev/pts devpts gid=5,mode=620 0 0

/dev/md0 none swap sw 0 0

/dev/md1 /boot ext3 defaults 0 0

/dev/md2 / ext4 defaults 0 0 errors=remount-ro,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0 0       1

From: Rifqi Kennedy at: 2013-03-06 05:06:18

i can't install vim-nox, because this packets there isn't, how about that ??

From: at: 2011-10-29 02:17:34

For fail2ban and SASL read Debian bug #507990, it's important:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507990

From: bandie at: 2012-02-10 13:30:03

May I ask, How to regenerate all apache vhost config files at once? I have 4000 sites maintaned by ISPConfig and vhost template modified.

From: gibbo at: 2012-03-18 14:06:35

Hi

This has been a brilliant tutorial and i ve got my server working because of it, may i just ask how i know what my username and password would be for squirrel Mail Please, im ok with ispconfig but no idea what my password and username would be for the squirrelmail screen above

 Many Thanks

From: Marto at: 2011-02-21 12:59:35

my probelm with http://site.com/webmail not work but download file
Decision:
edit / etc/apache2/mods-enabled/suphp.conf
comment out this section:

# <Directory /usr/share>
# SuPHP_Engine off
# </ Directory>

/ etc/init.d/apache2 restart

edit / etc/apache2/mods-enabled/suphp.conf
uncomment those lines

<Directory /usr/share>
suPHP_Engine off
</ Directory>

a2dismod suphp
/ etc/init.d/apache2 restart

From: at: 2011-02-23 15:14:23

Hi ; put the solution the Marto, is not funtionally, but , if install CMS , example joomla, 

 the error is if install any component appear "error 500 internal error"

 any solution for this solution?

From: Anonymous at: 2011-04-01 20:41:32

Thx, very great Tutorial

From: Mindscape at: 2011-05-02 21:20:44

It works great but i cant send emails. I always get the error Sender address rejected: not logged in.

From: Axel at: 2011-05-19 12:06:01

same here :(

From: Enes Mujovi at: 2011-11-16 03:54:30

for me don't work this?? 20 Additional Notes 20.1 OpenVZ VPSID=101 for CAP in CHOWN DAC_READ_SEARCH SETGID SETUID NET_BIND_SERVICE NET_ADMIN SYS_CHROOT SYS_NICE CHOWN DAC_READ_SEARCH SETGID SETUID NET_BIND_SERVICE NET_ADMIN SYS_CHROOT SYS_NICE do vzctl set $VPSID --capability ${CAP}:on --save done please help me

From: at: 2012-03-20 13:07:42

Edit your /etc/vz/conf/<<VZID>>.conf

(Check if it´s on another place i´m using proxmox then on pmox the file is located on this place)

 Check if CAPABILITY line exists. if not copy the line below and put it on your container config.

#Extras Ispconfig3
CAPABILITY="CHOWN:on DAC_READ_SEARCH:on SETGID:on SETUID:on NET_BIND_SERVICE:on NET_ADMIN:on SYS_CHROOT:on SYS_NICE:on SYS_TIME:on"

From: MyName at: 2012-02-07 10:08:35

Hi there,

No troubles at all! All steps on all the pages worked perfectly! 
Thank you for taking the effort to create this manual!

Rgds,

Marcel / Get IT Service

From: pallermo at: 2012-08-03 08:18:19

Hi guys, this is so great tutorial! Till now I had small problem with quota but now I saw another issue with ftp server. Everything is working correctly (I mean on FTP) but when I access to a folder I can easily go up in upper foler from my home directory. At this way I can come to / and to read eveything. (I can't delete but never mind). My home dir for ftp is example: /var/www/clients/client1/web3/ftp - so I can enter to /var/www/clients/client1/web3/ in reverse till root folder / :)

Does anybody know how to block this? PureFTPD doesn't have configuration file, it has run options. Maybe somebody faced also with this kind of problem.
Thanks

 

 

 

From: Adrian at: 2012-08-08 23:15:54

I have big problems with dns...

 root@server1:/nslookup localhost
;; Got SERVFAIL reply from 193.231.236.17, trying next server

 

 Pls help..

From: at: 2013-03-23 16:40:52

Hi Falko,

In my opinion this is the best tutorial for installing ISPConfig 3.  I refer to this time and time again. The amount of detail you put into this is greatly appreciated.

Great!  Thank you...

 Darin

From: Yvanoph at: 2013-06-28 18:40:15

Hi there, use this few times and was well workin, till six months ago, last time in fact I used !

But today, "php -q install.php" is not working ans send me "bash" : php

Deleted all, ask since beginning, but I have every time the same answer !

I bought book about how to use ISPConfig3 at  their Site .org, but unfortunately, nothing explained about to how to put in place ? ? ?

So, something changed ?

Kind regards, Yvanoph---

 

P.S. Sorry for my poor English, I don't use every day to write since may 30 years...