Migrating from "mdir" to Zimbra

[czaveri]

I have a Surgemail Server that stores mails as mdir format.

I also have a Zimbra Server. I gathered from the Forums that Zimbra stores the Metadata in database and the Message seperately in a MIME file.

I wish to migrate from Surgemail to Zimbra. But I authenticate my users using Enternal LDAP. The OpenLDAP server that contains users' passwords, encrypts them. I have many users - such that I cannot ask passwords from all. I do not want to change their passwords.

One solution for migration that I understand is as follows:

1. Save Users' Passwords from LDAP.
2. Set a New Password for all Users, one which is known by us.
3. Migrate Users' Accounts using this new password and an IMAP Migration tool, such as IMAPSync.
4. Reset the Users' Passwords to their Original ones.

One disbenefit, that I foresee in this process is that, from the time when I change the user's password until the time when this password is reset, the User cannot login because he will use the password that LDAP had earlier but is not using it now because his account is being migrated. I also understand that I can only change the password for the user who is being currently migrated and after restoring his original password, I would proceed with the next user.

However, I have a many users who have tens of thousands of messages and being extremely heavy users of email, are continuously accessing it. In this case there will be a service downtime for these users which I cannot afford.

Also, I would want to Sync the messages, that I receive/delete/send in Zimbra with Surgemail, about twice a day. Again, while I Sync these messages via IMAP, these users will see downtime.

So, I am looking for a solution which will enable me to: Migrate from Surgemail to Zimbra, and, Synchronize Accounts on Surgemail with Zimbra (after migration) as a routine without knowing the Users' Passwords.

For this, I am willing to spend some time and write a script if it is not very difficult to understand what to do. I know a little Perl and if I can be given a few tips, I might be able to manage 2 scripts one for each purpose.

Thank-you,

- Chintan.

[KevinH]

imapsync shouldn't cause downtime. You should be able to do it while user's are logged in.

For auth you can just have Zimbra auth against your existing LDAP and this will keep you from needing to sync passwords. You'd still need something to sync create/delete's in LDAP but that's an easier problem to solve.

Is this a temp solution and eventually you'll turn off the old system, or do you actually plan to run both systems in parallel for a long period of time? If so why?

[czaveri]

Yes, Kevin, you are right in that IMAPSync will not cause any downtime. In fact, none of the systems will have a downtime. However, there will be a downtime in service to the user because we would be changing the password in order to do the IMAP migration - since, IMAPSync will not transfer messages unless we provide it with the User's Password on both IMAP Servers.

This password will not be known to the User - and so he will not be able to access his mailbox while the messages are being transferred. Because, even if I use Zimbra's Internal Authentication, I would still need to Authenticate myself on Surgemail.

We are currently in the process of testing Zimbra and if all is well - maybe in a few months - we would migrate completely to it. In addition, so far the most universal thing is IMAP and so to keep integrity of emails in a format that can be used by "any" email aplication it is essential to maintain Surgemail - atleast for the time being - until our organization decides to part from it.

[rsharpe]

My suggestion would be to setup a slipt domain: http://wiki.zimbra.com/index.php?title=Split_Domain then migrate the users a few at a time instead of syncing twice a day. You may have to do some after hours work when the user or users have left for the day, but that is the life of an admin. If for some crazy reason you decide not to implement Zimbra you can always migrate the user back. IMHO I believe you are making it out to be much more difficult than it really needs.

[czaveri]

Thank-you for your reply rsharpe. I think what you say, might be a good idea if I had users in one Timezone.

We have users in almost all countries - and all the users are active and have very heavy usage. The smallest mailbox I know is about 2500 Emails!

I am not a Senior Linux Admin and have limited experience working in a Production Environment like this - which is why, probably, I am trying to take extra care.

If no previously implemented solution exist then I was hoping to learn how the messages are stored in Zimbra. This way I can probably conduct a few experiments...

Thank-you,

Sincerely,

Chintan Zaveri.

[rsharpe]

It'll still work if you have users across multiple timezones.

For example i'm in EST (GMT -5) timezone, and say I have a users in PST (GMT -8) timezone I could migrate all those PST users at 8am EST, that would make it 5am PST. Most people would be sleeping at this time and wouldn't notice the change. I would have to say you are at an advantage because you wouldn't have to do all your work after hours at midnight, because for some employees it will be midnight for them but 1pm for you, and thats when you do the work, no disruptions for them, I wouldn't imagine they're sending emails at midnight. Would you agree?

[czaveri]

Yes I agree

[rholbert]

I don't think imapsync supports it yet, but Cyrus SASL supports the concept of proxy authentication. That's where you authenticate as an admin user, then you pretend to be a normal user. This way you don't have to mess with resetting each user's password.

I used a simular method in a custom Python script when we migrated our users from Sendmail to iPlanet a few years ago.

Another useful tool is Perdition.

http://www.vergenet.net/linux/perdition/

It's an IMAP/POP proxy server. We used perdition to do a gradual migration, and it redirected the users to their correct mail box.

Hope this helps.

Rick

[KevinH]

Originally Posted by rholbert

Another useful tool is Perdition.

For the record Zimbra ships this by default.

[czaveri]

Thank-you very much rholbert and thank-you very much Kevin. This will help me very much.

Will post a story once the migration is over (maybe by this weekend).

Sincerely,

Chintan Zaveri.