Turnkey Zimbra installation

[bmunger]

Hello,

I'm new to Zimbra, but I have a few years of experience running Unix systems. I'm pretty proficient with computers, was sysadmin for a few years as secondary duties, so I can understand DNS, SMTP, HTTP, etc, the buz words (most of them). But I'm no expert. I'm looking for a simple way ton install Zimbra on a home server.

I've downloaded and installed Turnkey Zimbra on an old PC. It runs on Ubuntu 8.04. It installed rather easily and did not really give me any serious error messages.

I ran the zimbra-conf script, as described on the turnkey website:
Zimbra Appliance | TurnKey Linux Virtual Appliance Library

I have a fixed IP from my Internet Service Provider (ISP), it's pointing towards the machine name with a fully qualified DNS hostname.

I have a firewall wireless box and I've openned a lot of ports on the firewall (or rather point them towards the server and use NAT, Network Address Translation, to access it from outside of my LAN).

I have succeeded in connecting for the Zimbra server via the www, but not the administration web interface. It locks on me. I had to add users using the zmprov command with a putty telnet-ssh connection.

I also have trouble connecting via Zimbra desktop to my server from outside of my LAN (I have not yet tried from inside my LAN, I installed this morning and I'm at work now!). It gives me the following error:

"http://mail.ingenieur.org/service/soap/" host not found. Please check hostname and network connectivity.

I'm wondering if I have a service to activate on the server... or if I forgot to open a port on my firewall...

[Dirk]

On the premise that it's operational, you'll not have to "activate" external access on the zimbra server, it'll be listening on ports 80 and 443 by default.
You will need to add a port forward on your firewall/router for it though.

At a minimium, you will need to allow all traffic on ports 25 and 443 from the outside world to hit your zimbra server. Also, you'll need a hostname and MX record for your external IP address.

[bmunger]

Originally Posted by Dirk

At a minimium, you will need to allow all traffic on ports 25 and 443 from the outside world to hit your zimbra server. Also, you'll need a hostname and MX record for your external IP address.

Hello Dirk,
Thank's for the quick reply, it's appreciated.

I can access the server for common users via port 80 and I did open 443 also (pointed it to the internal machine).

I guess I should test internal to my LAN first, removing the firewall box from the equation.

By the way, Zimbra really looks good and the Zimbra Desktop look very professsional at first glance (I've yet to try it with more intensity). The look is good and the functionality seems to be all there.

Good job!

[bmunger]

Originally Posted by Dirk

Also, you'll need a hostname and MX record for your external IP address.

I forgot: my IP address is fixed and it resolves to a valid fully qualitfied hostname. The MX record does not yet point towards the server, but I did not think this would prevent it from displaying the administration web interface... could it?

[bmunger]

Originally Posted by Dirk

On the premise that it's operational, you'll not have to "activate" external access on the zimbra server, it'll be listening on ports 80 and 443 by default.
You will need to add a port forward on your firewall/router for it though.

At a minimium, you will need to allow all traffic on ports 25 and 443 from the outside world to hit your zimbra server. Also, you'll need a hostname and MX record for your external IP address.

I finally got it to work internally to my LAN. I am able to access the web administration interface and login as a normal user.

One other problem:the certificates are the ones comming from the turnkey zimbra installation. I tried to install a new certificate via the administration interface but I keep getting a "server error encountered" message. Here is the core of the message:
"Message: system failure: exception executing command: zmcertmgr createcsr self -new .... etc...etc... Error code: service.FA..."

Any clues?

Next is trying to figure out why I cannot acess it from outside of my LAN.
I am redirecting the following ports from my router to the internal linux machine:
25 (SMTP)
21 (FTP)
110 (POP3)
23 (Telnet)
80 (HTTP)
443 (HTTPS)
22 (ssh)
7071 (Admin for Zimbra)
465 (SMTP secure)
995 (POP3 secure)
143 (IMAP)
993 (IMAP secure)
12320 (Webshell)

Do I need to open any other ports?

I cannot access the administration interface with the port 7071 when outside of my LAN.

Thank's for the help

[Dirk]

I try to avoid looking at SSL certificates whenever possible, me and SSL have a long history of mutual contempt, so I'll leave that for someone else to answer.

The external access is a bit of a mystery. You dont need to open any more ports, and if you plan to use only the Zimrba web interface to view and send mail then you only need 80 or 443 opening, nothing else.

25 will need to be open to recieve mail from the outside world of course, but is not needed for testing.

Looks like there's something odd at the router side. Try connecting via a telnet session to port 25 or 23, see if you get any responses, if not then the port forwarding is not working correctly.

What is your network configuration, is is a DSL modem connected to a router and another port on the router connected to the zimbra server?

Lastly, I could be chasing a ghost here, because this is running a prebuild zimbra as opposed to a server you installed yourself, there could be something in that build image that is causing the problem. Have a look at iptables on the turnkey zimbra to see if that's blocking external connections.

[bmunger]

Originally Posted by Dirk

Lastly, I could be chasing a ghost here, because this is running a prebuild zimbra as opposed to a server you installed yourself, there could be something in that build image that is causing the problem. Have a look at iptables on the turnkey zimbra to see if that's blocking external connections.

OK, so I've decided to install from scratch. I'm installing Debian Lenny 5.04.

What is the first thing to do? Remove the mail server? Is there a list of things to do to get this installed quickly and easily?

[bmunger]

Originally Posted by Dirk

Lastly, I could be chasing a ghost here, because this is running a prebuild zimbra as opposed to a server you installed yourself, there could be something in that build image that is causing the problem. Have a look at iptables on the turnkey zimbra to see if that's blocking external connections.

I'm trying this procedure:
GNR on Debian Lenny - Zimbra :: Wiki

[bmunger]

Originally Posted by Dirk

Lastly, I could be chasing a ghost here, because this is running a prebuild zimbra as opposed to a server you installed yourself, there could be something in that build image that is causing the problem. Have a look at iptables on the turnkey zimbra to see if that's blocking external connections.

OK, I've gone up to the step of installing dependencies in the instructions here:
GNR on Debian Lenny - Zimbra :: Wiki

I downloaded both GNR605 and GNR606 using perforce P4, so I have the choice of either one.

I ran into an error when performing the installation of the dependencies. the sun-java5-jdk and 6 and jre packages all gave me an error:
"Couldn't find any package whose name or description matched..." with the package names.

Is that a show stopper? Do I need to fix this by adding a repository or do I go through the Synaptic Package downloader to find Java 5 and Java 6 and install them before continuing the instructions?

Any other set of instruction known to work and be failure-proof for Debian 5.0.4?

I'd like to have Zimbra, but I do not want to spend the next week configuring a unix machine, I've got 4 kids!!!

[Dirk]

Unless there's a good reason not to, my firm recommendation is to grab a Ubuntu Server cd (ideally 64 bit depending on your hardware) and install that, basic install, no extras. That takes about 30 mins or less.

The download and install zimbra for that platform and install it. The whole thing can be done in around an hour from powering the machine up. I've done it a few times before of course, so call it two hours and you should be covered.

That said, the version you are using really should be working; but as there's no real data in it yet, i'd just build a fresh box.