stressfree - scalix

Quickly restarting the Scalix IMAP server process

David — Thu, 23 Nov 2006 08:06:41 +0000

Note to self, to quickly restart the Scalix IMAP server process use the following command at the shell:

omoff -d 0 -a IMAP & omon IMAP

scalix

Changing the LDAP port Scalix uses

David — Tue, 17 Oct 2006 09:27:16 +0000

Scalix runs its own instance of OpenLDAP for authentication purposes and by default this operates on port 389 which is the standard port for LDAP. The only problem with this is that you cannot run a 'proper' LDAP service (OpenLDAP, FedoraDS, eDirectory) on the standard LDAP ports without there being a conflict with the Scalix service. Fortunately there is a simple workaround that lets you run the Scalix service on a non-standard port.

Edit the /var/opt/scalix/sys/slapd.conf file and change the setting portNum to a non-standard (preferably high-level) port. In this example I will use port 6389 but it can be any port that is not currently being used by another service.

portNum 6389

Now edit the /etc/opt/scalix/caa/scalix.res/config/ubermanager.properties file and set the ubermanager.query.server.port to the same value:

ubermanager.query.server.port=6389

Save the changes and restart Scalix for the new LDAP port settings to take effect.

Scalix and Apple Mail

David — Wed, 11 Oct 2006 06:36:01 +0000

OSX Mail is a typical Apple product, it has some great features that make it fantastic but it is let down by the tiny details. For example I've been battling with it's 'Synchronize IMAP Account' feature and its ability to almost crash my Scalix mail server. The feature is useful because it creates a local copy of an on-line IMAP account for SpotLight searching and general offline use. Unfortunately if this process is run after a long period of time offline it can cause the Scalix IMAP server to trip up and not allow further IMAP connections.

I've been on the Scalix forums trying to resolve this issue and it seems like the root cause is a hard-coded limit of 17 simultaneous IMAP connections within Scalix. Unfortunately OSX Mail creates multiple simultaneous connections when performing the synchronization process and just to make matters worse it takes its own sweet time in closing them. Consequently it does not take long for the 16 process limit to be reached, the Scalix IMAP server to trip over and the Mail client to be left out in the cold.

The most annoying thing about the problem is that unlike Thunderbird, OSX Mail offers no way to limit the number of simultaneous connections, thus getting around the issue. Fortunately it sounds like the server team will resolve this hard coded process limit bug, perhaps in time for Scalix 11, so the annoying issue maybe resolved once and for all.

osx
scalix

Ensuring mail can be sent via Scalix Webmail

David — Sat, 07 Oct 2006 04:07:24 +0000

The Scalix Webmail client requires an authenticated smtp connection in order to be able to successfully send messages. If the Scalix smtpd service is not configured to allow annoymous smtp connections from the Webmail host then the client will receive the following Javascript error:

methodname = send

To correct this edit the Scalix smtpd configuration file at /var/opt/scalix/sys/smtpd.cfg and ensure the Webmail server is added as a source that can send annoymous email. For example in my network the Webmail server (Tomcat) is at 10.1.1.40 so the configuration file looks like this:

RELAY accept 127.0.0.1
RELAY accept .stress-free.co.nz
RELAY Log_Reject ALL

ANONYMOUS accept 127.0.0.1
ANONYMOUS accept 10.1.1.40
ANONYMOUS Log_Reject ALL

# extra rules added to prevent open relay usage
RECIPIENT Log_Reject *@*@*
RECIPIENT Log_Reject *%*
RECIPIENT Log_Reject *!*
RECIPIENT Log_Reject *#*@*

AUTH_SUCCESS Header .pwd.stress-free.co.nz
AUTH_SUCCESS Accept ALL

After editing this file restart Scalix smtpd for the changes to take effect:

sudo omoff -d0 smtpd && sudo omon smtpd

email
scalix

Enabling SMTP relay (smarthost) in Scalix

David — Thu, 05 Oct 2006 19:01:29 +0000

By default Scalix configures itself to operate as a standalone mail server which is normally what client's want. Unfortunately the IP range my ISP owns is frequently flagged by anti-spam services making mail delivery to certain recipients challenging. Fortunately my ISP provides an SMTP relay server for customers on the network which is not effected by the broad blocks applied to the IP range I am on.

To configure Scalix to use the SMTP relay for outgoing mail edit /etc/mail/sendmail.cf and find the line that reads:

And change it to:

DSrelay.smtpserver.com

Restart sendmail and you will find all your external mail sent via Scalix is relayed via the ISP's SMTP server. To check it is all working send an email and then view the /var/logs/mail file, the last entry should show a log of the outgoing mail with the relay recorded next to it.

If you make this change just make sure your domain SPF record is modified to ensure it defines the ISP's SMTP server as a source that is allowed to send mail on behalf of your name. The best SPF wizard I have found is hosted by OpenSPF and makes creating this potentially complicated DNS entry straightforward.

email
scalix

Two Scalix tips: Apache vhosts and keeping deleted mail

David — Thu, 28 Sep 2006 05:01:16 +0000

Scalix is a powerful, stable and soon to be almost completely open sourced email server. Unfortunately like many commercial products it is still a little rough round the edges when it comes to doing things outside of the supported method. Here is a couple of tips that may help you out when wanting to take Scalix "off-road" so to speak...

Keeping deleted mail indefinitely

I like to keep deleted mail mainly because I have a habit of deleting most non-business things soon after reading them. What normally happens is that a month later I remember something about an email I've read but deleted so I want to go back to it. Unfortunately by default Scalix wants to delete mail deleted mail after twenty four hours. Its not a bad default policy but changing it is not simple (though hopefully will get easier in later versions).

To change this policy open the general.cfg file in /var/opt/scalix/sys/ and add the following line to the buttom:

UAL_NO_WB_EMPTY=TRUE

Restart Scalix and it should no longer clear out deleted mail.

Integrating Scalix into an Apache Virtual Host

Another problem area with Scalix occurs in its assumption that the server it is installed on will be dedicated to email and will not have to work around or integrate into other existing services. I combine my email and Web services onto one server and within Apache there are numerous virtual hosts. I only want Scalix Web services to be exposed on a single domain (webmail.stress-free.co.nz) but by default it wants to create the Tomcat connector and CGI aliases across every single domain.

To fix this first disable the Scalix Apache include files. There are several installed in /etc/apache2/conf.d and another reference in /etc/sysconfig/apache2 that looks like this:

APACHE_CONF_INCLUDE_DIRS=/opt/scalix/global/httpd/scalix-web-client.conf

Now edit your virtual host that you want to serve email. Below is an example of my /etc/apache2/vhosts.d/webmail.stress-free.co.nz.conf illustrating the numerous Scalix specific entries required for the different services (this is used on Suse 10):

<VirtualHost 10.1.1.10:80>
ServerAdmin admin@stress-free.co.nz
ServerName webmail.stress-free.co.nz
# This is the fqdn for the Scalix server and is needed for SAC to work
ServerAlias scalix.stress-free.co.nz
DocumentRoot /srv/www/vhosts/webmail.stress-free.co.nz

ErrorLog /var/log/apache2/webmail.stress-free.co.nz-error_log
CustomLog /var/log/apache2/webmail.stress-free.co.nz-access_log combined
CustomLog /var/log/apache2/webmail.stress-free.co.nz-ssl_request_log ssl_combined

HostnameLookups Off
UseCanonicalName Off
ServerSignature On

<IfModule mod_jk.c>
# Send Scalix specific urls to a mod_jk worker named scalix (ajp13)
JkMount /webmail/* scalix
JkMount /sac/* scalix
JkMount /caa/* scalix
JkMount /webcal/* scalix
JkMount /res/* scalix
</IfModule>

<Directory "/srv/www/vhosts/webmail.stress-free.co.nz">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
</VirtualHost>

<IfDefine SSL>
<IfDefine !NOSSL>
<VirtualHost 10.1.1.10:443>
ServerAdmin admin@stress-free.co.nz
ServerName webmail.stress-free.co.nz
# This is the fqdn for the Scalix server and is needed for SAC to work
ServerAlias scalix.stress-free.co.nz
DocumentRoot /srv/www/vhosts/webmail.stress-free.co.nz
ErrorLog /var/log/apache2/webmail.stress-free.co.nz-error_log
CustomLog /var/log/apache2/webmail.stress-free.co.nz-access_log combined
CustomLog /var/log/apache2/webmail.stress-free.co.nz-ssl_request_log ssl_combined

HostnameLookups Off
UseCanonicalName Off
ServerSignature On

# This by default redirects visitors to the login screen
Redirect /index.html https://webmail.stress-free.co.nz/webmail/

<Directory "/srv/www/vhosts/webmail.stress-free.co.nz">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>

# This sets up mod_jk for Scalix Tomcat -> Apache interaction
<IfModule mod_jk.c>
# Send everything for context /examples to worker named scalix (ajp13)
JkMount /webmail/* scalix
JkMount /sac/* scalix
JkMount /caa/* scalix
JkMount /webcal/* scalix
JkMount /res/* scalix
</IfModule>

# Scalix cgi-bin aliases
Alias /omhtml/ /var/opt/scalix/omhtml/
AliasMatch ^/omhtml\.([^/]*)/ /var/opt/om.$1/omhtml/

ScriptAlias /Scalix/rw /opt/scalix/bin/ice.cgi/prof=RW-C
ScriptAliasMatch ^/Scalix/rw-(.*) /opt/scalix/bin/ice.cgi/prof=RW-$1

# Add legacy PAW profile also ...
ScriptAlias /Scalix/paw /opt/scalix/bin/ice.cgi/prof=PAW-C
ScriptAliasMatch ^/Scalix/paw-(.*) /opt/scalix/bin/ice.cgi/prof=PAW-$1

ScriptAlias /Scalix/wap /opt/scalix/bin/ice.cgi/prof=WAP-C
ScriptAliasMatch ^/Scalix/wap-(.*) /opt/scalix/bin/ice.cgi/prof=WAP-$1

<Directory "/opt/scalix/bin">
AllowOverride None
Options +ExecCGI -Includes
Order allow,deny
Allow from all
AddDefaultCharset off
</Directory>
<Directory "/var/opt/scalix/omhtml">
AllowOverride None
Order allow,deny
Allow from all
AddDefaultCharset off
</Directory>

SSLEngine on
SSLCipherSuite HIGH:MEDIUM
SSLCertificateFile /etc/apache2/ssl.crt/www.stress-free.co.nz.crt
SSLCertificateKeyFile /etc/apache2/ssl.key/www.stress-free.co.nz.key
SSLProtocol all -SSLv2
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

</VirtualHost>
</IfDefine>
</IfDefine>

I am using the Suse mod_jk library not the Scalix supplied version. This is configured in /etc/apache2/conf.d/mod_jk.conf and for my system looks like this:

<IfModule mod_jk.c>
JkWorkersFile /etc/apache2/workers.properties
JkLogFile /var/log/apache2/mod_jk.log
JkLogLevel info
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
JkRequestLogFormat "%w %V %T"
</IfModule>

This configures mod_jk and references the /etc/apache2/workers.properties file which looks like this for my server:

worker.list=scalix

worker.scalix.type=lb
worker.scalix.balanced_workers=scalix1

# Set properties for worker1 (ajp13)
worker.scalix1.type=ajp13
worker.scalix1.host=127.0.0.1
worker.scalix1.port=8009
worker.scalix1.lbfactor=50
worker.scalix1.cachesize=10
worker.scalix1.cache_timeout=600
worker.scalix1.socket_keepalive=1
worker.scalix1.reclycle_timeout=300

Restart Apache and hopefully you should find Scalix works for your virtual host (and only your virtual host). If you have experience with configuring Apache2 and Tomcat you should find this relatively straightforward but if you don't it will be quite intimidating sorry.

linux
scalix

Sorting out Scalix tantrums

David — Sat, 23 Sep 2006 12:05:33 +0000

This morning after making some file changes and performing a server restart I found the Scalix 10 email server would not load. As I have never had to resolve major problems with Scalix determining the cause and solution to this error turned out to be a worthwhile experience.

Manually starting and stopping Scalix

According to the Scalix startup script (/etc/init.d/scalix) the service was successfully starting, but on closer inspection none of the actual processes were beginning. Unfortunately whilst the /etc/init.d/scalix script is a tidy way of controlling Scalix it does not provide any console logging to explain any issues that maybe encountered. For more useful output the two console commands that start/stop Scalix are:

omrc - start Scalix
omshut - stop Scalix

Thanks to omrc I was able to see that according to Scalix one of the core services, the Remote Client Interface (RCI), was in a 'shutdown process' and could not be loaded. A look on the Scalix Community Forums quickly came up with the answer here which was to run the command:

omreset -o off rci

The omreset command manually sets the status of the various Scalix services and the above comand forces the RCI service to the off state.

With this problem fixed Scalix successfully started happily enough but I then found that whilst I could log into the Administration interface, POP and SMTP services I could not however use IMAP or Webmail as my username/password was rejected. Solving this problem was a little trickier than the first but fortunately a look in the SAC administration IMAP logs showed that there were some file permissions errors occurring as a consequence of the file changes I had undertaken before the server reboot.

Checking file permissions

Fortunately Scalix has a very useful tool for checking and correcting file ownership and privilege issues called omcheck. To correct file privilege issues run the following command:

omcheck -s -d > /tmp/check_file ; sh /tmp/check_file

The above runs the omcheck command on the Scalix application and data files. Results are output to /tmp/check_file as a series of comments and chmod commands to correct any permission errors. Once omcheck has completed the output (tmp/check_file) is executed by the shell (sh), automatically correcting any issues found. I was relieved to see that after running this command IMAP and Webmail were once again working fine.

Overall solving these Scalix issues was a very good learning experience. It took quite a long time simply because of my limited experience of dealing with Scalix issues and the overly complex manner by which Scalix is configured and operates compared to other email servers. All of the answers were found on the Scalix Community Forums but finding them took a lot of searching, reading and experimenting. There is a lot of content on the forums mainly I think because Scalix is overly complex and can easily lead to problems. Hopefully with Scalix 11 and future versions these configuration and maintenance tasks become simpler, more concise and a lot more intuitive.

Migrating to and using Scalix 10

David — Mon, 31 Jul 2006 00:15:29 +0000

Last week this post on my local Linux user group got me rethinking email servers. The last time I did this was about six months ago when I made the move away from Hula onto Zimbra. At the time I looked at Scalix 9 but was deterred by its need for X-Windows during the install process and the overwhealming amount of installation documentation that came with the 100+mb download. I decided to go with Zimbra because it offered a text-based installer and some very nice looking UI features on the webmail client.

Unfortunately over time I have become tired of Zimbra for a number of reasons:

The installation essentially takes over the host operating environment and installs its own version of popular open source applications like MySQL and Apache. Consequently keeping up with security patches involves upgrading the entire mail system which is no straightforward task.
Zimbra is very resource intensive and takes what seems like forever to initally load and shutdown. This seems to mainly revolve around their management tools which store all configuration information in an LDAP database and dynamically build the traditional configuration text files on loading.
Because most configuration information is stored in the LDAP datasource making configuration tweaks by editing the traditional text cofiguration files is not possible. Instead you must read through the Zimbra administration documentation to identify LDAP attributes to tweak in order to achieve the intended output. This is frustrating and not very transparent when things go wrong.
The webmail interface is slow to operate and load (especially for dial-up/slow DSL users). After about three months I disabled the webmail interface and began using Roundcube's php IMAP frontend. There was a loss of functionality but at least performance was smooth on any connection.
Because of the way Zimbra sets up its own services it is hard to integrate it successfully into an existing environment. I only have one IP address and port 80/443 is forwarded through to my LAMP server. After a great deal of experimenting I could not get the LAMP server to natively host the Zimbra webmail client, instead I had to resort to using a nasty mod_proxy configuration (which probably attributed to the slowness for external users).
Zimbra does not offer Outlook/iSync connectors for its open source users, in order to get access to these connectors you must pay many $$$ a year in licensing costs. In small installations this is just not cost-effective.

Scalix 10 on the other hand addresses many of the shortcomings I found in Scalix 9 and Zimbra.

It ships with a console based installer which is a welcome sight. Rather than providing its own stack it integrates into your operating systems existing applications (Sendmail, Apache, Cyrus-SASL and even Java if you want). This makes keeping your server up to date with the latest security patches a lot easier and upgrading to the latest and greatest Scalix release less of a concern.
The webmail interface is based entirely in Java (running in Tomcat) and can be easily setup to be accessed from an external web-server (such as a dedicated LAMP box) using mod_jk.
Scalix even in the free Community Edition version offers 25 free Outlook Connector licenses which makes it practical for use within small businesses.
Rather than storing all configuration data in an LDAP datasource most configuration occurs in the standard text files for the system with a little bit of tweaking taking place in the /var/opt/scalix/ directory. This makes tweaking a lot easier as information found on the Web can be directly applied to Scalix.
There seems to be a great deal of support available for Scalix ranging from the comprehensive bundled documentation and Knowledge Base through to the Community Forums and Wiki. Between those four sources of information I haven't yet found a problem that has not been able to be resolve.

Installation

I installed Scalix on a virtual Xen instance which contained a minimum install of SUSE 10. After accepting the license agreement the installer ran through a system and dependency check. At this point it returned a nice list of changes I needed to make to the system before installation could occur. This mainly revolved around the installation of some packages and a tweak of the /etc/hosts file in order to reduce the risk of confusion later on. It also gave me a warning about memory which would be easily solved later on by giving the Xen instance access to more server memory.

Console installation (click to enlarge)

Once the dependencies were met Scalix happily installed. At the end of the process I was asked if I wished to install included versions of Java/Tomcat or use my own. I opted to use the bundled versions out of simplicity and on looking at the configuration files after the installation I can see it is a straightforward job if you wish to change your mind and use a different JVM or J2EE server once things have gone into production.

With Scalix, Java and Tomcat installed, the server reconfigured and the basic admin account setup all the services were started and the installer finished. It was the moment of truth so I fired up a web browser and made my way to the Scalix administration console.

Server administration via SAC (click to enlarge)

Disabling mod_deflate because of Firefox 1.5 on OSX

At this point I came across my first issue and it was not really with Scalix. For some reason Firefox 1.5 for OSX on my Mac cannot handle content compressed with mod_deflate very well. Consequently the Scalix administration interface took forever to load. Switching to a different browser fixed this problem but as Firefox was my default browser I decided to disable mod_deflate for the time being.

This involved tweaking Scalix's Apache configuration files. In doing so I was pleasantly surprised to find that the Scalix installer had been very neat and courteous when making its modifications. I have seen a number of applications make horrendous system configuration changes but Scalix was a good server citizen. It had added three extra .conf files into /etc/apache2/conf.d and each were well named and commented. The installer had also modified the /etc/sysconfig/apache2 file to add the jk and deflate modules to Apache and this change too had been performed in an appropriate manner. I disabled the configuration file in /etc/apache2/conf.d associated with mod_deflate, restarted Apache and everything worked as expected in Firefox.

Adding user accounts and doing basic system maintenance

Using the web-based Scalix Administration Console (SAC) it is possible to perform all the basic mail administration tasks like adding/deleting users and monitoring mail queues. The console is designed to enable the management of multiple mail servers but the functionality available through it is not as extensive as other administration interfaces I have used. For example there are no options to edit what mail services (pop/imap/smtp/webmail) start on boot or modify details about a particular service (like port numbers, security settings, etc). Changes like this are possible but it requires console-based editing of configuration files. Personally I do not see this as a bad thing but if you are pro-GUI administrator making the switch from Exchange or Zimbra you will probably be disappointed.

User administration (click to enlarge)

When creating user accounts you can select whether the account is Premium (Outlook, IMAP, POP3), Standard (IMAP/POP3) or Internet (Webmail only) which is a nice touch. The Community Edition of Scalix allows only 25 Premium accounts, any more than that and you must upgrade to a paid-for version. Upgrading to a different version of Scalix is as simple as purchasing a license and entering its details into the SAC. This means a Scalix Community Edition server can be installed, tested and demoed at zero-cost and then painlessly upgraded if and when the server goes into full-scale production.

Scalix server statistics (click to enlarge)

Migrating existing mail

Scalix provide a suite of tools for seamlessly migrating users from Exchange which is their core target audience. Unfortunately as I was not running Exchange I could not test these out. It seems like the standard way of migrating non-Exchange mail onto Scalix was through the manual creation of user accounts and then transfer of mail using the Perl-based imapsync tool. There maybe a smarter way of doing this but the Scalix documentation I found did not provide any hints.

Imapsync is a very functional piece of software but it is a little troublesome to setup if you are not used to Perl. It requires a number of libraries that by default are not installed with Perl but fortunately are all available in CPAN. Once the tool is running migration was straight-forward but it is important to set the --setinternaldates flag so that migrated mail retains the original arrival time (otherwise everything will get listed as turning up on the same day). The process does take a while and is fairly resource intensive, running the imapsync process from a third computer during a time when mail activity is low is recommended.

Using Scalix

With the user accounts and mail transferred it was now a case of using it. The Webmail interface works very well and is a lot snappier than Zimbra's. It is also relatively straightforward to configure Webmail to be routed through an intermediate server providing other Web services. Doing so requires some understanding of mod_jk which is a bit of a dark art though not as bad as regular expressions or mod_rewrite. Fortunately the installed Scalix configuration files are well commented and provide even mod_jk novices with enough insight that setting configurations like this up should not be too much of a problem.

Webmail interface (click to enlarge)

There was a weird bug with Scalix and OSX Mail's Kerberos implementation. On setting up an IMAP account in Mail the application automatically sets itself to exchange passwords using Kerberos but this does not work (my guess is an incompatibility between the two implementations). This issue can be solved by changing the authentication encryption to MD5 in Mail. The weird thing is when setting up Scalix as an SMTP service Mail automatically sets encryption to MD5 and works quite happily without further user input.

Scalix with Outlook

I do not use Outlook but I was interested in trying out the Scalix Connector for Outlook. Setting up the connector was more than a simple case of pointing Outlook to Scalix and telling it that it was actually Exchange. The process required the installation of a Scalix Connector package on the Windows client and then migration of the standard Outlook account to a special Scalix-enabled version. Fortunately all of these tasks can be automated to enable network roll-out but I found the documentation just a little bit too light in places to feel really comfortable about what I was doing. Once setup the results were pretty impressive, 99% of all the Exchange functionality is available using the connector and it appeared to be very fast and stable.

The Outlook connector and webmail (click to enlarge)

Shortcomings for the non-technical administrator

By default Scalix does not ship with any anti-virus or anti-spam software. There are numerous pieces of documentation on how to set these things up but it revolves around making configuration file changes using the console. Here again Exchange administrators will not feel too comfortable and would probably prefer the Web-based check box functionality of Zimbra when it comes to setting up anti-spam and virus services. But if you are prepared to get your hands a little dirty the end-results will be a lot better, more flexible and most importantly when things go awry you will have a better understanding of what exactly is going on.

Conclusion

For those administrators out there that do not want to mess with complex console work Scalix is not for them. Installing and configuring Scalix will take more time than Exchange which will offset some of the licensing savings. However once it is up and running it is very stable and flexible system with all the power of Exchange without the licensing, security and reliability concerns that come with Microsoft software.