zarafa November 2011

zarafa@lists.fedoraproject.org

1 participants
3 discussions

pam_mapi - PAM module for authentication via MAPI against a Zarafa server
by Robert Scheck 30 Nov '11

30 Nov '11

Good evening, I'm very proud to present you my first PAM module which maybe makes the life of some Zarafa administrators more easy; it's called "pam_mapi". I also would like to thank hereby Tomas Mraz (Red Hat Czech), Tom Callaway (Red Hat USA) and Kushal Das (Red Hat India) for their time, patience and support! Especially Tomas did an awesome job by reviewing my source code. pam_mapi is a module for PAM (Pluggable Authentication Modules). PAM is a library that provides an interface for authentication services for Linux/ Unix systems and therefore allows to connect various system services with one central authentication database. Administrators can ensure for example, that all services are using a centrally stored password - and finally prevent separate password databases. The PAM module "pam_mapi" takes care of the authentication with a Zarafa server as a password database. Applications such as Zarafa WebAccess, the Zarafa WebApp or Microsoft Outlook (with the Zarafa Windows Client) connect directly via MAPI to SOAP to the Zarafa Collaboration Platform and also handle the authentication via that protocol when sending e-mails. If Zarafa is configured to use the database plugin, all user information are stored in a MySQL database. Once IMAP/POP3 is used via the Zarafa Gateway, often SMTP gets involved for outbound e-mails, too. Usually this requires SMTP authentication (also called "SMTP auth") in order to avoid socalled open relays but the user information in the MySQL database is unfortunately not accessible for established SASL daemons. Although the password is generally hashed with MD5, is also salted with a non-standard method. That surely improves security, but Cyrus SASL for example expects a plaintext password expected in the database, if the plugin "SQL auxprop" is used. The socalled "frost patches" unfortunately do not help here as well - given that they are not included in leading Linux distributions which are being used in Enterprise environments. And pam_mysql supports MD5 or SHA1 hashed passwords (aside from plaintext passwords), but only without salts. This gap is filled by pam_mapi which provides MAPI-based authentication, that can be used by a SASL daemon for the SMTP service. Typically, Sendmail or Postfix uses "saslauthd" (from Cyrus SASL), then takes care via pam_mapi for the verification of the user information from the SMTP dialogue. Finally, pam_mapi establishs a connection to the configured Zarafa server and performs a login - and the result is returned accordingly to the SMTP service which permits or rejects the outbound e-mail connection. pam_mapi is licensed under the new BSD license (no advertising, three clause). Alternatively, pam_mapi may be distributed under the terms of the GNU General Public License (GPL), in which case the provisions of the GNU GPL are required instead of the restrictions of the BSD license. This clause is necessary due to a potential conflict between the GNU GPL and the restrictions contained in a BSD-style copyright. As pam_mapi is a generic PAM module, it could be used for any other PAM related authentication, e.g. at the Apache Webserver. If it is stacked with pam_unix it could allow authentication against Linux system and Zarafa users, where a user only needs to exist in one of the two user databases. However pam_mapi provides a limited PAM account functionality, because the existence of an account can be only assured after succeeded authentication. Although pam_mapi was primarily developed for use with Zarafa and the database plugin, it is not limited to that. However, if the LDAP or Unix plugins of Zarafa are used, the usage of pam_unix or pam_ldap should be evaluated. At the moment, Zarafa is the only MAPI service provider of MAPI4Linux (which is used by pam_mapi), but pam_mapi theoretically supports various MAPI-based server services (e.g. Microsoft Exchange). The installation of pam_mapi on Fedora or Red Hat Enterprise Linux can be simply performed via "yum". Note, that for Red Hat Enterprise Linux and derivates like CentOS, the repository Extra Packages for Enterprise Linux (EPEL) has to be enabled: http://fedoraproject.org/wiki/EPEL/FAQ#howtouse yum install -y pam_mapi If the package is not yet available in the repositories, you can download it manually from https://admin.fedoraproject.org/updates/search/pam_mapi. After the installation, the configuration is required. A very common setup will be to only authenticate against Zarafa, thus only Zarafa users. Please put the following into the PAM configuration file for SMTP, usually it is named "/etc/pam.d/smtp": #%PAM-1.0 auth required pam_mapi.so try_first_pass account required pam_mapi.so Alternatively, if the authentication shall happen against system and Zarafa users, put the following into the "/etc/pam.d/smtp" file: #%PAM-1.0 auth sufficient pam_mapi.so try_first_pass quiet auth include password-auth account sufficient pam_mapi.so account include password-auth Configuration of "saslauthd" for usage of PAM as authentication mechanism is possible in "/etc/sysconfig/saslauthd". Of course the MTA (Mail Transfer Agent), so Sendmail or Postfix for example, must be configured for the use with "saslauthd". If you use Sendmail, edit "/etc/mail/sendmail.mc" and add for example the following (in a simple setup): TRUST_AUTH_MECH(`LOGIN PLAIN')dnl define(`confAUTH_MECHANISMS', `LOGIN PLAIN')dnl Instead, if you are using Postfix, edit "/etc/postfix/main.cf" and add the following at the proper places or to existing configuration directives: smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination Additionally, Sendmail users need to fill "/etc/sasl2/Sendmail.conf" or "/usr/lib(64)/sasl2/Sendmail.conf" and Postfix users need to fill the file "/etc/sasl2/smtpd.conf" or "/usr/lib(64)/sasl2/smtp.conf" with following: pwcheck_method: saslauthd mech_list: plain login Finally, restart the affected service, so for Sendmail: service sendmail restart And if you are a Postfix user, execute this command: service postfix restart Independent of Sendmail or Postfix, the "saslauthd" needs to be restarted: service saslauthd restart For more information for configuring and possible options can be found in the man page: man pam_mapi In case you need help, you could write an e-mail to the Zarafa mailing list at the Fedora Project on http://lists.fedoraproject.org or you could join the IRC network Freenode on channel #zarafa. And if you should find bugs or issues, please fill a bug report in Red Hat Bugzilla as described here: http://fedoraproject.org/wiki/Zarafa#Bugs Your feedback is very much appreciated. Greetings, Robert

1 0

Zarafa 7.0.3 has been submitted to updates-testing
by Robert Scheck 19 Nov '11

19 Nov '11

Good evening, Zarafa 7.0.3 has been submitted to updates-testing (EPEL 5 and 6, Fedora 14, 15 and 16). The zarafa-indexer subpackage is now available on Fedora 16 as well thanks to the clucene09 compatibility package. There are no updated packages for Fedora Rawhide at the moment, because of some incompatibility of the filesystem API of Boost 1.48.0 and Zarafa. Here is the full list of changes in Zarafa 7.0.3 [30515]: Zarafa Collaboration Platform 7.0.3 Final [30515] ================================================= Backend ======= - Fix ZCP-8768: Memleak in GetDeferredCount(). - Fix ZCP-8727: Mandriva packages contain wrong names and dependencies. - Fix ZCP-8769: Some threads fail to exit on server shutdown and can cause high load. - Fix ZCP-6574: There's a possible refcount issue with ECMsgStore and it's IMSLogon interface. - Fix ZCP-7895: FireFox drag and drop plugin does not work with Single sing on. - Fix ZCP-8353: Zarafa-server segfaults when migrating zarafa-client to 6.40.8. - Fix ZCP-8099: Zarafa-passwd: not possible to change passwd. - Fix ZCP-8119: Possible error in BaseRecurrence constructor. - Fix ZCP-8139: Support for forward as inline email rule. - Fix ZCP-8163: Index file of backup contains moved files twice (ZCP-6704) for subfolders. - Fix ZCP-8197: Headers not correctly parsed when an empty line is in the headers. - Fix ZCP-8242: Segfault zarafa-server 7.0.0. (Rare occasion) - Fix ZCP-8338: Optional attendee sees "undisclosed-recipients" as additional attendee. - Fix ZCP-8340: Zarafa-ical segfault on 6.40.11 during curl ics import. - Fix ZCP-8357: The Zarage Migration Tool (and it's installer) should check for the correct .NET version instead of crashing when the correct version is absent. - Fix ZCP-8362: Zarafa-backup should use store GUIDs, not store ids to backup orphaned stores. - Fix ZCP-8366: Fix that accepting an exception the user gets the error "Can not find object". - Fix ZCP-8367: PR_ICON_INDEX value for cancellation meeting request mail is wrong. - Fix ZCP-8375: PR_PARENT_ENTRYID different for messages directly in the Public Folders IPM Subtree. - Fix ZCP-8411: Send as rights not correctly upgraded from 6.30 to 6.40 only 1 is saved. - Fix ZCP-8415: Include the final release of Zarafa migration tool in this release. - Fix ZCP-8417: Send email to emailaddress which contains space will fail. - Fix ZCP-8432: Zarafa-server may hang after TERM signal. - Fix ZCP-8421: Receive timeout too low for some XML requests. - Fix ZCP-8428: Zarafa-server Segfault in 6.40.11.(Rare occasion) - Fix ZCP-8455: Freebusy data not showing correctly in VBA. - Fix ZCP-8470: Create option to disable emailing to the group everyone. - Fix ZCP-8491: Fix PHP errors in debug.txt. - Fix ZCP-8519: Zarafa-ical high load on Zarafa 7.0.2. (Option to disable get in ical.cfg) - Fix ZCP-8521: Search folders containing single quotes break python upgrade script. - Fix ZCP-8529: IMAPITable cursor is wrong on modification. - Fix ZCP-8541: Zarafa-server segfault on shutdown.(Rare occasion) - Fix ZCP-8543: Re-doing a store migration with Zarafa-MSR fails. - Fix ZCP-8552: Zarafa-fsck segfault on 7.0.2 beta 1.(Rare occasion) - Fix ZCP-8553: Zarafa-dev package is broken. - Fix ZCP-8558: All day event changed back to all day event after you made a normal appointment of it. - Fix ZCP-8561: Option counter_reset not documented in server.cfg manpage. - Fix ZCP-8563: Extend the zarafa-admin --force-resync that a resync will also work when a user is moved with the Zarafa-msr. - Fix ZCP-8565: Server log line about --force-database-upgrade option deprecated in version 7. - Fix ZCP-8567: Zarafa-indexer crashes if the default open file limit of 1024 is reached. - Fix ZCP-8571: Contacts are not displayed in multi-tenant setup when you have view privileges on other company. - Fix ZCP-8575: Zarafa-indexer sometimes complains about 'IndexRead out of date'. - Fix ZCP-8577: Do not migrate the property PR_INTERNET_CONTENT from exchange to zarafa with the Zarafa Migration Tool. - Fix ZCP-8579: Freebusy publish may crash when public doesn't work correctly. - Fix ZCP-8586: Caldav service segfault if the Authorization header base64 data doesn't contain a colon separator. - Fix ZCP-8587: Segfault zarafa-server 7.0.2.(Rare occasion) - Fix ZCP-8590: Zarafa schema doesn't include the sendasprivilege attribute for groups. - Fix ZCP-8600: Different customers reported the issue that spooler can hang after weekly logrotate. - Fix ZCP-8603: Cannot use caldav calendars on IOS5. - Fix ZCP-8605: Create an option which disables the storage of RFC822 files on disk when using IMAP to import messages. - Fix ZCP-8614: Zarafa-MSR cannot find user stores with non ascii characters in their names. - Fix ZCP-8621: Public calendar gives error messages in log with ical-4 and Thunderbird. - Fix ZCP-8616: Unable to accept a meeting request from Gmail via Mac ical. - Fix ZCP-8627: Zarafa-admin --list-companies and --details type company does not show set system admin. - Fix ZCP-8632: PR_HTML property broken with some messages after migration from Scalix. - Fix ZCP-8633: Recurring meeting request with exceptions from iCal contains attachments. - Fix ZCP-8641: Add full GAB resync capability. - Fix ZCP-8643: Unable to deliver to email adres that is shared by a contact and a user. - Fix ZCP-8645: BES connector usually needs server_address which is not in default config file. - Fix ZCP-8646: Remove all the mysql queries with NOW(). - Fix ZCP-8689: Multiple day event will span 1 day early in October on black berry. - Fix ZCP-8692: Zararfa7-upgrade script exits when it finds a missing database revision. - Fix ZCP-8693: Mysql deadlock in deferredupdate table. - Fix ZCP-8694: IMAP can access invalid memory when receiving invalid fetch command. - Fix ZCP-8697: Rule forward may create bad 'Sent' header in body. - Fix ZCP-8698: Cells in tables can be NOT FOUND in category-expanded view. - Fix ZCP-8700: Deadlock insert into syncedmessages table. - Fix ZCP-8703: SQL deadlock in table changes. - Fix ZCP-8704: Forward flag is visible for all users when delivering email to group, where one user has a forward rule. - Fix ZCP-8714: Allow limiting of the number of search results for the indexer. - Fix ZCP-8715: Mysql deadlock when inserting into hierarchy table. - Fix ZCP-8718: Network delays can cause infinite loop in ICS. - Fix ZCP-8720: ICS can deadlock in abort. - Fix ZCP-8721: Missing ADS Zarafa contacts tab. - Fix ZCP-8723: MR Autoresponder to book resources from outlook 2010. (A script that responds on behalf of the resource) - Fix ZCP-8726: Add zarafa-stats --top option to zarafa-stats man-page. - Fix ZCP-8728: Delete meeting request in Ical 4/5 will give error. - Fix ZCP-8732: Zarafa spooler segfault. (Rare occasion) - Fix ZCP-8731: Unable to commit message: 0x80040116 is shown with a specific eml file. Webaccess ========= - Fix ZCP-8767: When replying, <> in the SMTP addresses of the sender/recipients in the email are escaped HTML entities - Fix ZCP-8738: Unable to see free/busy information in WebAccess. - Fix ZCP-8011: Private marked contact still show to delegate without permissions. - Fix ZCP-8569: Fix that the "Delete From Calendar" functionality is working again. (WebApp) - Fix ZCP-7990: Forward specific emails with webaccess will lose part of body text, with outlook is works correctly. - Fix ZCP-8201: Selected email will be lost after sorting in webaccess. - Fix ZCP-8238: Feature: Forwarding as well as a redirect rule within webaccess. - Fix ZCP-8330: Cancellation send when trying to delete a meeting request with Only read permissions on calendar. - Fix ZCP-8395: It's not possible to save a change meeting request body as an organiser without sending the actual update. - Fix ZCP-8397: Firefox dialogues are rendered to small on Linux desktop. - Fix ZCP-8419: Date picker does not show bold dates when appointments are present. - Fix ZCP-8430: Calendar List view > Optional/required attendees disappears. - Fix ZCP-8439: Delete a meeting as an attendee and send a response does not sends a correct startdate n enddate in decline message to organizer. - Fix ZCP-8474: User in a redirected rule is moved to the forwarding field. - Fix ZCP-8476: Opening a redirected rule changes the name of the attendee. - Fix ZCP-8515: Unable to cancel a meeting request with a resource. - Fix ZCP-8523: Recurring item wrongly shown if all day event is set before creating occurrence. - Fix ZCP-8525: Freebusy selection is wrong when adding all day appointment. - Fix ZCP-8527: Popup appears when using Ctrl + Enter shortcut in html mode in Firefox. - Fix ZCP-8536: Possible to assign a task without a recipient. - Fix ZCP-8537: Replying to a mail with an inline attachment shows inline.txt in the body. - Fix ZCP-8584: webaccess doesn't recognize mimetypes of attachments of items imported from a PST. - Fix ZCP-8588: Feature: Support in webaccess to create a rule forward as inline attachment. - Fix ZCP-8661: Sunday 30th of October is listed twice in freebusy overview and all appointments made are shifted + 1 day. - Fix ZCP-8678: Fix for ZCP-7945 breaks webapp. - Fix ZCP-8681: Extra space present in 'To' display name when an e-mail was forwarded by a rule created with the WebAccess. - Fix ZCP-8730: Appointment freebusy time picker position incorrect. - Fix ZCP-8739: Webaccess not displaying any lines after a certain combination of characters. You should be able to update to Zarafa 7.0.3 by using something like: yum update --enablerepo=updates-testing 'zarafa*' on all Fedora releases and for Fedora EPEL you should use the following: yum update --enablerepo=epel-testing 'zarafa*' After testing, please add positive or negative karma to the Zarafa packages in Bodhi: https://admin.fedoraproject.org/updates/zarafa And if you should find bugs or issues, please fill a bug report in Red Hat Bugzilla as described here: http://fedoraproject.org/wiki/Zarafa#Bugs Your feedback is very much appreciated. Greetings, Robert

1 0

Zarafa 6.40.12 has been submitted for testing updates (EPEL 4 only)
by Robert Scheck 19 Nov '11

19 Nov '11

Good evening, Zarafa 6.40.12 has been submitted to the testing updates - for EPEL 4 only. As mentioned already a couple of times, EPEL 4 will stay on 6.40 series until Red Hat Enterprise Linux 4 reaches end of lifetime at 2012-02-29. I recommend to upgrade to a newer version of Red Hat Enterprise Linux, if you would like to use Zarafa 7 and its new features. Here is the full list of changes in Zarafa 6.40.12 [29942]: Zarafa Collaboration Platform 6.40.12 Final [29942] =================================================== Backend ======= - Fix ZCP-8228: Zarafa-msr should validate the destination servers. - Fix ZCP-8102: Sorting on email address breaks on names with " " (quotes). - Fix ZCP-8103: Delegate is listed as optional and required attendee after accepting a meeting request on behalf of. - Fix ZCP-8173: SaveObject() notifies grandparent about change even if there is no change. - Fix ZCP-8221: Patch to fix install.sh for RHEL6. - Fix ZCP-8354: Zarafa-msr relocation crash zarafa 6.40.11. - Fix ZCP-8461: Ical sends meeting request to organizer. - Fix ZCP-8512: MSR broken due to merge. - Fix ZCP-8522: Static function from class.recurrence.php is not supported in PHP4. - Fix ZCP-8393: Merge translations for 6.40.12. - Fix ZCP-7950: LDAP query conflicts sometimes with users/contacts. - Fix ZCP-7982: PHP include files of php-ext use mktime() without arguments. This results in PHP error for WebApp. - Fix ZCP-8013: An option for zarafa-backup which sets the servers to backup. - Fix ZCP-8055: Correctie man page zarafa-admin --hookstore. - Fix ZCP-8062: Config.php.dist in source package contains dos enters . - Fix ZCP-8082: PR_EC_PUBLIC_IPM_SUBTREE_ENTRYID fails to return correct proptag in GetProps(). - Fix ZCP-8093: Add zarafa-msr example config to zarafa-multiserver package. - Fix ZCP-8098: Zarafa-passwd: not possible to change passwd. - Fix ZCP-8115: Let Zarafa-admin --details always show Mb and not Kb for the storesize. - Fix ZCP-8121: Out of office is sent if delegate receives copies of meeting releated messages. - Fix ZCP-8130: PHP commandline can cause SIGSEGV. - Fix ZCP-8149: Zarafa-admin --list-companies tries double free on a user object. - Fix ZCP-8156: Zarafa-admin --utf8 --create-store --lang "en_US" fails silently. - Fix ZCP-8160: Zarafa Monitor and stats show 'wrong' information. - Fix ZCP-8164: Index file of backup contains moved files twice (ZCP-6704) for subfolders. - Fix ZCP-8198: HTML Filter is filtering out lines while it should not. - Fix ZCP-8205: Pthread_join called twice on the same pthread_t in WSStreamOps::CloseAndGetAsyncResult() and Release(). - Fix ZCP-8235: Mac Ical 5 does not work with Zarafa. - Fix ZCP-8245: Zarafa-backup can fail after deleting some folders. - Fix ZCP-8269: Company store size only contains public folder size. - Fix ZCP-8271: Indexer doesn't delete lockfiles at startup, even though log message says it does. - Fix ZCP-8273: Messages are still accessible under the old entryid even after a move. - Fix ZCP-8276: GAB synchronization may stop on processing recreated objects. - Fix ZCP-8287: Remove 50% non-active limit, so you can have enough shared mailboxes when using the archiver. - Fix ZCP-8318: Merge Zarafe Migration Tool to 6.40 branch. - Fix ZCP-8339: Zarafa-ical segfault on 6.40.11 during curl ics import. - Fix ZCP-8356: The Zarafa Migration Tool (and it's installer) should check for the correct .NET version instead of crashing when the correct version is absent. - Fix ZCP-8371: PR_PARENT_ENTRYID different for messages directly in the Public Folders IPM Subtree. - Fix ZCP-8410: Sendas rights not correctly upgraded from 6.30 to 6.40 only 1 is saved. - Fix ZCP-8414: Make the final release of Zarafa Migration Tool. - Fix ZCP-8416: Send email to emailaddress which contains space will fail. - Fix ZCP-8427: Zarafa-server Segfault in 6.40.11. - Fix ZCP-8431: Server may hang after TERM signal. - Fix ZCP-8433: Zarafa-server crash after SIGUSR1. - Fix ZCP-8456: Receive timeout too low for some XML requests. - Fix ZCP-8469: IMPL Create option to disable emailing to the group everyone. - Fix ZCP-8531: Unable to connect to a shared calendar in iCal4. - Fix ZCP-8454: Freebusy data not showing correctly in VBA. - Fix ZCP-8578: Freebusy publish may crash when public doesn't work correctly. - Fix ZCP-8512: MSR broken due to merge. Webaccess ========= - Fix ZCP-8237: Feature: forwarding as well as a redirect rule within webaccess. - Fix ZCP-5346: After saving settings, WA always reloads. - Fix ZCP-6927: Cannot download attachments with php4. - Fix ZCP-7394: Reading pane setting is not used when pane is already on a folder. - Fix ZCP-8011: Private marked contact still shown. - Fix ZCP-7931: Merge WA trunk fixes for meeting request class to only set ResponseStatus property when user has really processed it. - Fix ZCP-7937: Merge WA fixes to show MR details when MR is opened in preview. - Fix ZCP-7938: Merge WA backend items to allow Webapp function to Create propose new time dialog. - Fix ZCP-7939: Merge WA backend fixes to create testcases for MeetingRequest class and document it properly. - Fix ZCP-7940: Merge WA fixes show MR details when MR is opened in showmail dialog. - Fix ZCP-8444: New appointments are set to a free status. - Fix ZCP-8448: Quick appointment in all day bar sets status to "busy". - Fix ZCP-8019: Implementation Username in WebAccess URL. - Fix ZCP-8056: Autopick: unable to autopick when resource is added. - Fix ZCP-8075: Attachment not in mail when send with Edit as New Message. - Fix ZCP-8077: Quick appointment in all day bar sets status to "busy". - Fix ZCP-8086: Reminders shown are not for the latest occurrence. - Fix ZCP-8137: Zarafa Webaccess 6.40.4 sets the birthday reminder incorrectly. - Fix ZCP-8174: CTRL+ENTER in WA if typing in body / body active in non-IE browsers. - Fix ZCP-8200: Selected email will be lost after sorting in webaccess. - Fix ZCP-8226: Merge Patch for Timezone function used in current webaccess is depricated in php 5.3. - Fix ZCP-8394: It's not possible to save a change meeting request body as an organiser without sending the actual update. - Fix ZCP-8396: Firefox dialogues are rendered to small on Linux desktop. - Fix ZCP-8418: Date picker does not show bold dates when appointments are present. - Fix ZCP-8429: Calendar List view > Optional/required attendees disappears. - Fix ZCP-8438: Delete a meeting as an attendee and send a response does not sends a correct startdate n enddate in decline message to organizer. - Fix ZCP-8473: User in a redirected rule is moved to the forwarding field. - Fix ZCP-8475: Opening a redirected rule changes the name of the attendee. - Fix ZCP-8479: Forward rule does not add original sender in body. - Fix ZCP-8514: Unable to cancel a meeting request with a resource. - Fix ZCP-8560: Attendee is removed from the forward/redirect field. You should be able to update to Zarafa 6.40.12 by using yum update --enablerepo=epel-testing 'zarafa*' on EPEL 4 once it's pushed to the repository. If you should find bugs or issues, please fill a bug report in Red Hat Bugzilla as described here: http://fedoraproject.org/wiki/Zarafa#Bugs Your feedback is very much appreciated. Greetings, Robert

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

zarafa November 2011