邮件服务器zimbra的搭建与使用

由于公司使用的是阿里的邮箱，由于个数限制。现在需要公司内部搭建一个邮件服务器,网上找了一部分开源软件最后选择使用zimbra

Zimbra的核心产品是Zimbra协作套件（Zimbra Collaboration Suite，简称ZCS）。除了它的核心功能是电子邮件和日程安排服务器，当然还包括许多其它的功能，就象是下一代的微软Exchange。在电子邮件和日程安排之外，它还提供文档存储和编辑、即时消息以及一个利用获奖技术开发的全功能的管理控制台。ZCS同时也提供移动设备的支持，以及与部署于Windows、Linux或apple操作系统中的桌面程序的同步功能。

环境

系统：Centos7
ip地址：192.168.2.141

安装前准备

1.关闭SELINUX并清空iptable规则

#关闭selinux
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/sysconfig/selinux
#清空防火墙规则
iptables -F
iptables -X
iptables -z
service iptables save
reboot

2.配置主机名

hostnamectl set-hostname email.cyzys.com
echo "192.168.2.141 email.cyzys.com" >> /etc/hosts

3.安装zimbra所需要的包和库

yum -y update
yum -y install perl perl-core nmap sudo libidn gmp libaio libstdc++ unzip sysstat sqlite nc

4.关闭安装的MTA服务

systemctl stop postfix.service
systemctl disable postfix.service

5.设置阿里域名解析（由于本身的mail域名被其他项目暂用，所以只能设置email的解析）

6.设置公司内部交换机端口转发，从外网转发到192.168.2.141

7.下载并解压zimbra（官网地址：https://www.zimbra.com/downloads/）

wget https://files.zimbra.com/downloads/8.6.0_GA/zcs-8.6.0_GA_1153.RHEL7_64.20141215151110.tgz
tar -zxvf zcs-8.6.0_GA_1153.RHEL7_64.20141215151110
mv zcs-8.6.0_GA_1153.RHEL7_64.20141215151110 /usr/local/zimbra

安装zimbra

cd /usr/local/zimbra./install.sh --platform-override
Operations logged to /tmp/install.log.2744
Checking for existing installation...zimbra-ldap...NOT FOUNDzimbra-logger...NOT FOUNDzimbra-mta...NOT FOUNDzimbra-dnscache...NOT FOUNDzimbra-snmp...NOT FOUNDzimbra-store...NOT FOUNDzimbra-apache...NOT FOUNDzimbra-spell...NOT FOUNDzimbra-convertd...NOT FOUNDzimbra-memcached...NOT FOUNDzimbra-proxy...NOT FOUNDzimbra-archiving...NOT FOUNDzimbra-core...NOT FOUNDPLEASE READ THIS AGREEMENT CAREFULLY BEFORE USING THE SOFTWARE.
ZIMBRA, INC. ("ZIMBRA") WILL ONLY LICENSE THIS SOFTWARE TO YOU IF YOU
FIRST ACCEPT THE TERMS OF THIS AGREEMENT. BY DOWNLOADING OR INSTALLING
THE SOFTWARE, OR USING THE PRODUCT, YOU ARE CONSENTING TO BE BOUND BY
THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS
AGREEMENT, THEN DO NOT DOWNLOAD, INSTALL OR USE THE PRODUCT.License Terms for the Zimbra Collaboration Suite:http://www.zimbra.com/license/zimbra-public-eula-2-5.htmlDo you agree with the terms of the software license agreement? [N] yChecking for prerequisites...FOUND: NPTLFOUND: nmap-ncat-6.40-7FOUND: sudo-1.8.6p7-17FOUND: libidn-1.28-4FOUND: gmp-6.0.0-12FOUND: libaio-0.3.109-13FOUND: libstdc++-4.8.5-4FOUND: unzip-6.0-15FOUND: perl-core-5.16.3-286Checking for suggested prerequisites...FOUND: perl-5.16.3FOUND: sysstatFOUND: sqlite
Prerequisite check complete.Checking for installable packagesFound zimbra-core
Found zimbra-ldap
Found zimbra-logger
Found zimbra-mta
Found zimbra-dnscache
Found zimbra-snmp
Found zimbra-store
Found zimbra-apache
Found zimbra-spell
Found zimbra-memcached
Found zimbra-proxySelect the packages to installInstall zimbra-ldap [Y] Install zimbra-logger [Y] Install zimbra-mta [Y] Install zimbra-dnscache [Y] nInstall zimbra-snmp [Y] Install zimbra-store [Y] Install zimbra-apache [Y] Install zimbra-spell [Y] Install zimbra-memcached [Y] Install zimbra-proxy [Y]
Checking required space for zimbra-core
Checking space for zimbra-store
Checking required packages for zimbra-store
zimbra-store package check complete.Installing:zimbra-corezimbra-ldapzimbra-loggerzimbra-mtazimbra-snmpzimbra-storezimbra-apachezimbra-spellzimbra-memcachedzimbra-proxyThe system will be modified.  Continue? [N] yRemoving /opt/zimbra
Removing zimbra crontab entry...done.
Cleaning up zimbra init scripts...done.
Cleaning up /etc/ld.so.conf...done.
Cleaning up /etc/logrotate.d/zimbra...done.
Cleaning up /etc/security/limits.conf...done.Finished removing Zimbra Collaboration Server.Installing packageszimbra-core......zimbra-core-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-ldap......zimbra-ldap-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-logger......zimbra-logger-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-mta......zimbra-mta-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-snmp......zimbra-snmp-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-store......zimbra-store-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-apache......zimbra-apache-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-spell......zimbra-spell-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-memcached......zimbra-memcached-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...donezimbra-proxy......zimbra-proxy-8.6.0_GA_1153.RHEL7_64-20141215151110.x86_64.rpm...done
Operations logged to /tmp/zmsetup04082016-205457.log
Installing LDAP configuration database...done.
Setting defaults...DNS ERROR resolving MX for mail.zimbra.com
It is suggested that the domain name have an MX record configured in DNS
Change domain name? [Yes]
Create domain: [email.zimbra.com] zimbra.comMX: email.zimbra.com (XXX.XX.XXX.XXX)Interface: 127.0.0.1Interface: ::1Interface: 192.168.2.141
done.
Checking for port conflictsMain menu1) Common Configuration:                                                  2) zimbra-ldap:                             Enabled                       3) zimbra-logger:                           Enabled                       4) zimbra-mta:                              Enabled                       5) zimbra-snmp:                             Enabled                       6) zimbra-store:                            Enabled                       +Create Admin User:                    yes                           +Admin user to create:                 admin@zimbra.com
******* +Admin Password                        UNSET                         +Anti-virus quarantine user:           virus-quarantine.vhwa2pqsa7@zimbra.com+Enable automated spam training:       yes                           +Spam training user:                   spam.jqlkpspj@zimbra.com      +Non-spam(Ham) training user:          ham.jztdgrii_b@zimbra.com     +SMTP host:                           email.zimbra.com               +Web server HTTP port:                 8080                          +Web server HTTPS port:                8443                          +Web server mode:                      https                         +IMAP server port:                     7143                          +IMAP server SSL port:                 7993                          +POP server port:                      7110                          +POP server SSL port:                  7995                          +Use spell check server:               yes                           +Spell server URL:                     http://mail.zimbra.com:7780/aspell.php+Enable version update checks:         TRUE                          +Enable version update notifications:  TRUE                          +Version update notification email:    admin@zimbra.com              +Version update source email:          admin@zimbra.com              +Install mailstore (service webapp):   yes                           +Install UI (zimbra,zimbraAdmin webapps): yes                           7) zimbra-spell:                            Enabled                       8) zimbra-proxy:                            Enabled                       9) Default Class of Service Configuration:                                s) Save config to file                                                    x) Expand menu                                                            q) Quit                                    Address unconfigured (**) items  (? - help) 6Store configuration1) Status:                                  Enabled                       2) Create Admin User:                       yes                           3) Admin user to create:                    admin@zimbra.com
** 4) Admin Password                           UNSET                         5) Anti-virus quarantine user:              virus-quarantine.vhwa2pqsa7@zimbra.com6) Enable automated spam training:          yes                           7) Spam training user:                      spam.jqlkpspj@zimbra.com      8) Non-spam(Ham) training user:             ham.jztdgrii_b@zimbra.com     9) SMTP host:                              email.zimbra.com               10) Web server HTTP port:                    8080                          11) Web server HTTPS port:                   8443                          12) Web server mode:                         https                         13) IMAP server port:                        7143                          14) IMAP server SSL port:                    7993                          15) POP server port:                         7110                          16) POP server SSL port:                     7995                          17) Use spell check server:                  yes                           18) Spell server URL:                        http://mail.zimbra.com:7780/aspell.php19) Enable version update checks:            TRUE                          20) Enable version update notifications:     TRUE                          21) Version update notification email:       admin@zimbra.com              22) Version update source email:             admin@zimbra.com              23) Install mailstore (service webapp):      yes                           24) Install UI (zimbra,zimbraAdmin webapps): yes                           Select, or 'r' for previous menu [r] 4Password for admin@zimbra.com (min 6 characters): [5okG5xTdX] 123456Store configuration1) Status:                                  Enabled                       2) Create Admin User:                       yes                           3) Admin user to create:                    admin@zimbra.com              4) Admin Password                           set                           5) Anti-virus quarantine user:              virus-quarantine.vhwa2pqsa7@zimbra.com6) Enable automated spam training:          yes                           7) Spam training user:                      spam.jqlkpspj@zimbra.com      8) Non-spam(Ham) training user:             ham.jztdgrii_b@zimbra.com     9) SMTP host:                               mail.zimbra.com               10) Web server HTTP port:                    8080                          11) Web server HTTPS port:                   8443                          12) Web server mode:                         https                         13) IMAP server port:                        7143                          14) IMAP server SSL port:                    7993                          15) POP server port:                         7110                          16) POP server SSL port:                     7995                          17) Use spell check server:                  yes                           18) Spell server URL:                        http://mail.zimbra.com:7780/aspell.php19) Enable version update checks:            TRUE                          20) Enable version update notifications:     TRUE                          21) Version update notification email:       admin@zimbra.com              22) Version update source email:             admin@zimbra.com              23) Install mailstore (service webapp):      yes                           24) Install UI (zimbra,zimbraAdmin webapps): yes                           Select, or 'r' for previous menu [r] rMain menu1) Common Configuration:                                                  2) zimbra-ldap:                             Enabled                       3) zimbra-logger:                           Enabled                       4) zimbra-mta:                              Enabled                       5) zimbra-snmp:                             Enabled                       6) zimbra-store:                            Enabled                       7) zimbra-spell:                            Enabled                       8) zimbra-proxy:                            Enabled                       9) Default Class of Service Configuration:                                s) Save config to file                                                    x) Expand menu                                                            q) Quit                                    *** CONFIGURATION COMPLETE - press 'a' to apply
Select from menu, or press 'a' to apply config (? - help) a
Save configuration data to a file? [Yes]
Save config in file: [/opt/zimbra/config.11982]
Saving config in /opt/zimbra/config.11982...done.
The system will be modified - continue? [No] yes
Operations logged to /tmp/zmsetup04082016-205457.log
Setting local config values...done.
Initializing core config...Setting up CA...done.
Deploying CA to /opt/zimbra/conf/ca ...done.
Creating SSL zimbra-store certificate...done.
Creating new zimbra-ldap SSL certificate...done.
Creating new zimbra-mta SSL certificate...done.
Creating new zimbra-proxy SSL certificate...done.
Installing mailboxd SSL certificates...done.
Installing MTA SSL certificates...done.
Installing LDAP SSL certificate...done.
Installing Proxy SSL certificate...done.
Initializing ldap...done.
Setting replication password...done.
Setting Postfix password...done.
Setting amavis password...done.
Setting nginx password...done.
Setting BES searcher  password...done.
Creating server entry for mail.zimbra.com...done.
Setting Zimbra IP Mode...done.
Saving CA in ldap ...done.
Saving SSL Certificate in ldap ...done.
Setting spell check URL...done.
Setting service ports on mail.zimbra.com...done.
Setting zimbraFeatureTasksEnabled=TRUE...done.
Setting zimbraFeatureBriefcasesEnabled=TRUE...done.
Setting TimeZone Preference...done.
Initializing mta config...done.
Setting services on mail.zimbra.com...done.
Adding mail.zimbra.com to zimbraMailHostPool in default COS...done.
Creating domain zimbra.com...done.
Setting default domain name...done.
Creating domain zimbra.com...already exists.
Creating admin account admin@zimbra.com...done.
Creating root alias...done.
Creating postmaster alias...done.
Creating user spam.jqlkpspj@zimbra.com...done.
Creating user ham.jztdgrii_b@zimbra.com...done.
Creating user virus-quarantine.vhwa2pqsa7@zimbra.com...done.
Setting spam training and Anti-virus quarantine accounts...done.
Initializing store sql database...done.
Setting zimbraSmtpHostname for mail.zimbra.com...done.
Configuring SNMP...done.
Setting up syslog.conf...done.
Starting servers...done.
Installing common zimlets...com_zimbra_adminversioncheck...done.com_zimbra_attachcontacts...done.com_zimbra_attachmail...done.com_zimbra_bulkprovision...done.com_zimbra_cert_manager...done.com_zimbra_clientuploader...done.com_zimbra_date...done.com_zimbra_email...done.com_zimbra_mailarchive...done.com_zimbra_phone...done.com_zimbra_proxy_config...done.com_zimbra_srchhighlighter...done.com_zimbra_tooltip...done.com_zimbra_url...done.com_zimbra_viewmail...done.com_zimbra_webex...done.com_zimbra_ymemoticons...done.
Finished installing common zimlets.
Restarting mailboxd...done.
Creating galsync account for default domain...done.You have the option of notifying Zimbra of your installation.
This helps us to track the uptake of the Zimbra Collaboration Server.
The only information that will be transmitted is:The VERSION of zcs installed (8.6.0_GA_1153_RHEL7_64)The ADMIN EMAIL ADDRESS created (admin@zimbra.com)Notify Zimbra of your installation? [Yes] no
Notification skipped
Setting up zimbra crontab...done.Moving /tmp/zmsetup04082016-205457.log to /opt/zimbra/logConfiguration complete - press return to exit

启动zimbra并查看状态

su - zimbra        #切换到zimbra用户
zmcontrol start    #启动zimbrazmcontrol status   #查看启动状态
Host email.cyzys.comamavis                  Runningantispam                Runningantivirus               Runningdnscache                Runningldap                    Runninglogger                  Runningmailbox                 Runningmemcached               Runningmta                     Runningopendkim                Runningproxy                   Runningservice webapp          Runningsnmp                    Runningspell                   Runningstats                   Runningzimbra webapp           RunningzimbraAdmin webapp      Runningzimlet webapp           Runningzmconfigd               Runningzmcontrol stop     #停止zimbra

访问zimbra管理页面，在浏览器输入：
https://192.168.2.141:7071
客户端地址：
https://192.168.2.141

配置web段ssl连接

1.准备工作

首先当然要去阿里云申请的ssl证书下载其他类型证书和根证书，解压缩后有两个文件上传到相应目录，

文件名类似4762328__cyzys.com.key和4762328__cyzys.com.pem

创建目录 /opt/zimbra/ssl/aliyunssl/ 上传这两个文件
2.通过openssl命令把阿里云的私钥转成zimbra能接受的格式

对比Let’s Encrypt和Wosign的证书，这里会涉及到转换阿里云的RSA密钥到PKCS#8的格式，两者的区别，在于开头和结尾的内容。zimbra是不能验证RSA秘钥的。

 mkdir /opt/zimbra/ssl/aliyunssl/cd /opt/zimbra/ssl/aliyunsslopenssl pkcs8 -topk8 -inform PEM -in 4762328__cyzys.com.key -outform PEM -nocrypt -out privkey.pemmv 4762328__cyzys.com.pem cert.pemchown zimbra:zimbra /opt/zimbra/ssl/aliyunssl/*

3.创建证书链中间证书chain.pem
在 /opt/zimbra/ssl/aliyunssl/ 创建chain.pem 文件,文件内容也就是中级证书(mid-digicert-ca) + 根证书（Digicert-OV-DV-root.cer）

将阿里云下载证书4762328__cyzys.com.pem的第二部分，也就是第二个—–BEGIN CERTIFICATE—–到—–END CERTIFICATE—–

copy到chain.pem中也就是中级证书(mid-digicert-ca)，再将发证机构的根证书追加到chain.pem中也就第二部分的根证书。

cat Digicert-OV-DV-root.cer >> chain.pem #可能还需要转换编码格式 dos2unix chain.pem

4.验证证书

/opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
** Verifying 'cert.pem' against 'privkey.pem'
Certificate 'cert.pem' and private key 'privkey.pem' match.
** Verifying 'cert.pem' against 'chain.pem'
Valid certificate chain: cert.pem: OK

5.部署证书
部署之前，进行备份

cp -a /opt/zimbra/ssl/zimbra /opt/zimbra/ssl/zimbra.$(date "+%Y%m%d%H%M%S")

在Zimbra SSL路径下复制私钥
在部署SSL证书之前，需要将privkey.pem移动到Zimbra SSL商业路径下，如下所示：

cp /opt/zimbra/ssl/aliyunssl/privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key

开始部署

 cd /opt/zimbra/ssl/aliyunssl/
/opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem

重启zimbra服务

su - zimbra
zmcontrol restart

查看证书

/opt/zimbra/bin/zmcertmgr viewdeployedcrt

配置阿里域名解析和内网端口转发

测试访问ssl和域名是否生效
https://email.cyzys.com/