Thursday, December 3, 2009

Install Iredmail use LDAP and Groupware Server use SOGO

I/INTRO

As document previous I intro to you how to install iredmail use Mysql as backend http://conheotiensinh.blogspot.com/2009/08/install-linux-mail-server-with-5.html.Today I Will intro to you how to install iredmail use LDAP as backend(config iredadmin for admin mailbox .If you use Mysql as backend(postfixadmin)).Beside I will intro install and config Groupware Server use SOGO

*SOGo is groupware server with a focus on scalability and open standards.

*SOGo provides a rich AJAX-based Web interface and supports multiple native clients through the use of standard protocols such as CalDAV, CardDAV and GroupDAV.

*SOGo is the missing component of your infrastructure; it sits in the middle of your servers to offer your users an uniform and complete interface to access their information. It has been deployed in production environments where thousands of users are involved.


II/INSTALL

1/Install iredmail as normal but attention ! you choose ldap as backend password of account postmaster


2/Install and config Iredadmin

Default after install finish you can use phpldapadmin for admin mailbox but It very hard for config

Step 1:install package need for install iredadmin

#yum install python-setuptools.noarch MySQL-python.i386 \
gcc.i386 gcc-c++.i386 openssl-devel.i386 python-devel.i386 \
openldap-devel.i386

#easy_install web.py Jinja2 python-ldap==2.3.8 netifaces
#
rpm -ivh http://www.iredmail.org/yum/rpms/5/mod_wsgi-2.5-2.ired.i386.rpm



Step 2:download Iredadmin(you need buy liscense because open source version only fearture create mailbox not create maillist but you can use phpldapadmin create mailist ) from http://iredmail.googlecode.com/files/iRedAdmin-0.1.1.tar.bz2
Step 3:Copy iRedAdmin to /var/www/, set correct file permissions
Step 4:
$ tar xjf iRedAdmin-0.1.1.tar.bz2 -C /var/www/ 
$ cd /var/www/

$ chown -R root:root iRedAdmin-0.1.1
$ chmod -R 0755 iRedAdmin-0.1.1

$ ln -s iRedAdmin-0.1.1 iredadmin


Step 5:Add apache configure file: /etc/httpd/conf.d/iredadmin.conf.

AddType text/html .py Order deny,allow Allow from all

Step 6:
Edit /etc/httpd/conf.d/ssl.conf, make iredadmin accessable via HTTPS. Add below lines before :

WSGIScriptAlias /iredadmin /var/www/iredadmin/iredadmin.py/ Alias /iredadmin/static /var/www/iredadmin/static/

Step 7:restart apache

/etc/init.d/httpd restart

Step 8:
Create MySQL database: iredadmin and grant privileges

$ mysql -uroot -p
mysql> CREATE DATABASE iredadmin DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;
mysql> USE iredadmin;
mysql> SOURCE /var/www/iredadmin/docs/samples/iredadmin.sql;
GRANT SELECT,INSERT,UPDATE,DELETE ON iredadmin.* TO
iredadmin@localhost IDENTIFIED BY '123' ;

FLUSH PRIVILEGES;

Step 9:Configure iRedAdmin

$ cd /var/www/iredadmin/ $ cp settings.ini.sample settings.ini


Edit settings.ini and set several variables


$ chmod -w settings.ini

Step 10:access iredamin:https://your_server_ip_address/iredadmin/

3/Install and config SOGO

Step 1:create repo for install SOGO by yum
create file /etc/yum.repos.d/inverse.repo with info

[RHEL5] name=Inverse SOGo Repository baseurl=http://inverse.ca/downloads/SOGo/RHEL5/$basearch gpgcheck=0

Step 2:install sogo

#yum install sogo
#yum install sope49-gdl1-postgresql(you can use mysql or oracle)

Step 3:Because SOGo requires a relational database system in order to store appointments, tasks and contacts information. It also uses the database system to store personal preferences of SOGo users.You need create DB and Grand permission

Step 4:Edit /home/sogo/GNUstep/Defaults/.GNUstepDefaults as image

Step 5:you need install add-on for thurderbird
http://www.sogo.nu/fr/downloads/frontends.html


Step 6:config thunderbird


If you only use the SOGo Connector plug in, you can still easily access your data.
To access your personal address book:
Choose Go > Address Book. Choose File > New > Remote Address Book.
Enter a signifcant name for your calendar in the Name feld.

Type the following URL in the URL feld: http://localhost/SOGo/dav/u1/Contacts/personal/ Click on OK.
To access your personal calendar:
Choose Go > Calendar.
Choose Calendar > New Calendar.
Select On the Network and click on Continue. Select CalDAV.
Type the following URL in the URL feld: http://localhost/SOGo/dav/u1/Calendar/personal/ Click on Continue.

STep 7:Test create 1 calendar in web it will auto sync to thunderbird

Wednesday, December 2, 2009

Monitor bandwidth with Netflow and PRTG(PFSENSE)

I/Intro

*NetFlow Analyzer is a, web based (no hardware probes), bandwidth monitoring, network forensics and network traffic analysis tool that has been optimizing thousands of networks across varied industries for peak performance and helping them to put their bandwidth for a better use. NetFlow Analyzer is a NetFlow, sFlow, JFLow (and more) collector, analyzer and reporting engine integrated together. With close to 4000 enterprises using NetFlow Analyzer for an in-depth visibility into their network traffic and its patterns, NetFlow Analyzer continues to earn trust of more users by giving business knowledge of real-time network behavior and how traffic impacts the network's overall health.

*PRTG Traffic Grapher is an easy to use Windows software for monitoring and classifying bandwidth traffic usage. It provides system administrators with live readings and long-term usage trends for their network devices. The most common usage is bandwidth management, but you can also monitor many other aspects of your network like memory and CPU utilizations.

II/Install

Step 1:install pfsense as normal

Step 2:install Service pfflowd(system->Packages chose pffflow click icon "+")

Step 3:Config Service pfflowd in pfsense (services -> pfflowd) and config as image with Host(address of machine install netflow) and click save

Step 4:config Service SNMP for PRTG(Services -> SNMP check enable as image )

Step 5 :install PRTG and Netflow .

Download PRTG:http://www.paessler.com/prtg6/download
Netflow:http://www.manageengine.com/products/netflow/download.html

install PRTG and Netflow auto

Step 6:restart pfsense

Step 7:Test
from 172.16.1.3 download check status prtg and netflow

Thursday, November 26, 2009

INSTALL MOD SECURITY ModSecurity (Web Application Firewall)

I/INTRO

ModSecurity is an open source intrusion detection and prevention engine for web applications. It operates embedded into the web server, acting as a powerful umbrella – shielding applications from attacks. ModSecurity supports both branches of the Apache web server.

The module filters, and optionally rejects, incoming requests based on a number of different criteria like CGI variables, HTTP headers, environment variables, and even individual script parameters. mod_security can also create an audit log, storing full request details in a separate file, including POST payloads (the audit feature can be turned on or off on a per-server or per-directory basis).

II/INSTALL


Step 1:You need install Microsoft Visual C++ 2008 Redistributable Package (x86) (if you use Apache in window).

If you use LINUX.you can install from source as:

#wget http://www.modsecurity.org/download/modsecurity-apache_2.5.11.tar.gz

#tar -xvzf modsecurity-apache_2.5.11.tar.gz

#cd modsecurity-apache_2.5.11

#./configure;make;make install

you can install It by yum if you use RHEL or CENTOS

prefer:http://www.jasonlitka.com/yum-repository/


Step 2:Configure

copy libxml2.dll to folder bin in folder Apache(/etc/httpd/)if you use window

Step 3:edit file httpd.conf

uncommend

  LoadModule unique_id_module modules/mod_unique_id.so 

Add this line at the bottom of Load Modules section:
LoadModule security2_module modules/mod_security2.so

Step 4:Test you change signature"SecServerSignature "IIS/7.5" " of webserver to IIS/7.5 and access to apache








Thursday, November 19, 2009

INSTALL hMailServer

I/INTRO

hMailServer is a free e-mail server for Microsoft Windows. It's used by Internet service providers, companies, governments, schools and enthusiasts in all parts of the world.

It supports the common e-mail protocols (IMAP, SMTP and POP3) and can easily be integrated with many existing web mail systems. It has flexible score-based spam protection and can attach to your virus scanner to scan all incoming and outgoing email.

prefer:http://www.hmailserver.com/

II/Functionality

1/Services(POP3,STMP,IMAP)
2/database support(Microsoft SQL Server, PostgreSQL and MySQL)
3/
webmail(you can use Roundcube,SquirrelMail ,AfterLogic WebMail Pro)
4/Security(hMailServer is pre-configured to have high security when it comes to relaying and authentication so that no one can use your server to send spam messages. It also supports the very popular open source virus scanner ClamAV. Configuring hMailServer to use ClamAV only takes a single click! The server also supports black list servers and other spam-stopping mechanisms such as SPF and MX lookups).
5/feature
* POP3, SMTP, IMAP
* Virtual domains
* Built-in backup
* SSL encryption
* Anti-spam
* Anti-virus
* Scripting
* Server-side rules
* Multilingual
* Routing
* MX backup
* Multihoming
* SQL backend
* Web administration
* ClamWin
* SpamAssassin
6/other(hMailServer can use account of Active directory)

III/INSTALL

Step 1:download hmail server from

http://www.hmailserver.com/index.php?page=download

Step 2:Install hmail server (it auto install)

Step 3: After install add domain(conheotiensinh.co.cc)


Step 4:Add Account you can use account of AD

Step 5:install web admin and Web mail


For easier install you can use xampp(http://www.apachefriends.org/en/xampp.html)


1/Web admin
- Copy folder PHPWebAdmin from in folder install hmailServer to folder htdocs of xampp
-Set the value of rooturl to the URL where the WebAdmin will be accessed.

Example:
$hmail_config['rooturl'] = "http://localhost/PHWebAdmin/";



2/Webmail
a/use SquirrelMail
Download It from (http://www.squirrelmail.org/download.php).In your mail folder, you will found a config folder with a file named config_default.php. Rename the config_default.php to config.php.Edit it

$domain
= "localhost"; $smtpServerAddress = "localhost"; // your hMailServer address $imapServerAddress = "localhost"; // your hMailServer address $imap_server_type = "hmailserver";
$data_dir = "C:/xampp/htdocs/mail/data/";
$attachment_dir
= "C:/xampp/htdocs/mail/attach/"

b/Use roundcube(recommend)
-Download from http://roundcube.net/
-Create database roundcubemail from phpmyadmin
-Rename your “db.inc.php.dist” to “db.inc.php” and “main.inc.php.dist” to “main.inc.php” in folder config of roundcube
-Edit your “db.inc.php” and change this line “$rcmail_config['db_dsnw'] = ‘mysql://roundcube:pass@localhost/roundcubemail’;” with this “$rcmail_config['db_dsnw'] = ‘mysql://root:@localhost/roundcubemail’;”
-access http://localhost/roundcubemail/installer and configure it


c/use AfterLogic WebMail Pro(not recommend Buy Liscense)

- Download from http://www.afterlogic.com/

-Access http://your_webmail_web_address/adminpanel/install.htm you will install it auto

Friday, November 13, 2009

VPN IPSEC SITE TO SITE WITH PFSENSE

I/INSTALL


you need install pfsense with info:


Site 1: Outside IP: 192.168.20.203/24
Outside Gateway: 192.168.20.254
Inside IP: 172.16.1.0/16

Site 2: Outside IP: 192.168.20.83/24
Outside Gateway: 192.168.20.254
Inside IP: 172.16.10.0/24



Step 1: Install pfsense and set local IP’s on both firewalls.

Step 2: Logon to the web interface for pfsense on each box and assign the WAN addresses.

Step 3: Enable IPSEC (VPN->IPSEC->Enable IPSec). Do this on both firewalls.

Step 4: Add a tunnel on Site 1’s firewall to Site 2 by adding a tunnel and changing only the following items:
* Remote Subnet: 172.16.10.0/24
* Remote Gateway: 192.168.20.83
* Phase 1 Lifetime: 28800
* PreShared Key: conheotiensinh
* PFS Key Group: 2
* Phase 2 Lifetime: 3600

Step 5: Add a tunnel on Site 2’s firewall to Site 1 by adding a tunnel and changing only the following items:
* Remote Subnet: 172.16.1.0/16
* Remote Gateway: 192.168.20.203
* Phase 1 Lifetime: 28800
* PreShared Key: conheotiensinh
* PFS Key Group: 2
* Phase 2 Lifetime: 3600

Step 6: "Apply Changes”

Step 7: Allow Authenticated Headers (TCP/51) and ISAKMP (UPD/500) with Firewall rules so that IPSEC can pass. Firewall->Rules: WAN Tab.
Rule 1
* Source IP: Any
* Destination IP: WAN Address
* Protocol: TCP
* Port: 51

Rule 2
* Source IP: Any
* Destination IP: WAN Address
* Protocol: UDP
* Port:500

Do this on both firewalls and Apply Changes when prompted

Step 8: Allow all traffic to pass through the IPSEC tunnel. Firewall->Rules : IPSEC Tab
Rule
* Source IP: Any
* Destination IP: Any
* Protocol: Any
* Port Range: Any

II/TEST

ping test connection from local in site 1 to site 2 and site 2 to site 1

Tuesday, November 10, 2009

SETUP VPN(PPTP SERVER) WITH PFSENSE

I/INTRO


PPTP works by sending a regular PPP session to the peer with the Generic Routing Encapsulation (GRE) protocol. A second session on TCP port 1723 is used to initiate and manage the GRE session. PPTP is difficult to forward past a network firewall because it requires two network sessions. As such, firewalls are unable to let pass this traffic flawlessly, resulting in an inability to connect.

II/ INSTALL

We need install pfsense with 2 interface

Wan interface:192.168.20.203
Lan interface:172.16.1.1

Step 1: Enable PPTP Server (VPN > PPTP).Setup as Image




*Redirect incoming PPTP connections to:If check you will redirect to other PPTP Server(Example Window PPTP)
*Use a RADIUS server for authentication:used Account of Radius(AD,FreeRadius...)

Step 2: create Account for access VPN (click tab users)

Step 3:create Rule for VPN Zone access internet


Step 4: connect to PPTP with ip:192.168.20.203 and test connection

Monday, November 9, 2009

INSTALL IPS(SNORT) WITH PFSENSE

I/INTRO

Pfsense use snort as IPS( Snort Used by fortune 500 companies and goverments Snort is the most widely deployed IDS/IPS technology worldwide. It features rules based logging and can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and much more. )

II/INSTALL

In This lab we need setup network with info:

Wan Interface:192.168.20.203
Lan Interface:172.16.1.1



STEP 1:Install pfsense as ip
STEP 2:Install snort(The package is available to install from System > Packages and you must only install SNORT or SNORT_DEV never both. It is strongly suggested you get a paid subscription form www.snort.org in order for you to download the latest rules. )
STEP 3:After Install done We configure snort(Services > Snort)click tab Setting and configure as image



Notes:

Block offenders:Pfsense will automatically block hosts that generate a snort alert
Remove blocked hosts every: It Will auto remove hosts from tab blocked
Oinkmaster code:you need register 1 Account in Snort or buy (http://www.snort.org/vrt/buy-a-subscription/ will get the the latest rule updates 30 days faster than registered users)


Step 4:click tab update rules(please waith about 4-10 minutes)

Step 5:Test before attack(ping external ip)


Step 6:user super scan tool scan ip external and check tab blocked


Step 7 :access agian ip external

Step 8:Delete ip attacker in tab blocked and test again


Beside You can use Blocking Skype ,Yahoo ,P2P.... with pfSense and Snort.I will intro later