IMP Installation
| only for RuBoard - do not distribute or recompile |
IMP Installation
In this section, I will guide you through the installation and configuration of IMP. The following steps depend heavily on the previous chapters. If you haven't finished the previous chapters successfully, IMP installation and configuration will fail. If you do have problems, see the troubleshooting section near the end of this chapter.
Obtaining the Software
You can download IMP from the Web site at http://www. horde .org. When you do, get version 2.0.11 because that is the version I will be working with.
NOTE
As of the writing of this book, IMP 2.2 became available. However, it is not yet ready for prime time. When I gave it my mailbox, it immediately logged me out. I'm sure it will be ready for use soon. After you have gone through the process of installing IMP 2.0.11, you can upgrade to IMP 2.2 because the concepts are very similar.
IMP version 2.2 includes session support, which requires PHP 4 (also newly released). This feature will make it a very nice upgrade.
The philosophy of this project is to give you a verifiably working product, which is IMP 2.0.11. By the time the book is in circulation, the newer version of IMP will have matured, and should be ready for general use. However, software never pays attention to schedules!
You can also check Macmillan's Web site for changes or corrections to this book. The Web site for updates to this book is
http://www.mcp.com/updates.cfm?item=0789724405
IMP comes in two parts . The first part is the horde library. Copy the horde-1.0.11.tar.gz file into the imp directory you created in your home directory. Also copy the imp-2.0.11.tar.gz file. Untar both, as shown in the following code:
[root@winbook imp]# tar xvzf horde-1.0.11.tar.gz
Output
......(file list printed here).... horde-1.0.11/templates/signup/signup.inc horde-1.0.11/templates/status/ horde-1.0.11/templates/status/status.inc
Output
[root@winbook imp]# tar xvzf imp-2.0.11.tar.gz .......(file list printed here)..... imp-2.0.11/templates/spelling/ imp-2.0.11/templates/spelling/footer.inc imp-2.0.11/templates/status/ imp-2.0.11/templates/status/body.inc [root@winbook imp]#
At this point, it is a good idea to look at the two directories that were created. Get a feel for the list of files and how the directory structure is arranged.
The next step is to copy the horde and IMP directories to the correct spot in the Web server directory structure. At the same time, we will rename them. The internal scripts expect to be in directories horde/ and horde/imp/:
[root@winbook imp]# cp -a horde-1.0.11 /home/httpd/html/horde [root@winbook imp]# cp -a imp-2.0.11 /home/httpd/html/horde/imp
You now have the basic system installed. It does not yet work properly. A couple of options are available for making IMP work. I will walk you through the Web-based setup of IMP. After it is finished, you will need to tweak a few settings in PHP to use IMP.
NOTE
IMP 2.0.11 does not work with PHP version 4. If you install PHP version 4 and try to run the IMP setup, you will get a Parse Error message on line 79 of the library file in the setup directory. The fix for this is to remove PHP 4 and install PHP 3.
PHP 4 is generally compatible with PHP 3, but some differences do exist. It will take some time for these differences to be well known.
IMP 2.2 has just been released. This new IMP requires PHP version 4 and requires the installation of a new PHP library. As of this writing, a new security hole has been found in it, and an update will be available almost immediately.
I have a philosophy about new releases. "Don't use version .0 (dot-zero) of any software package!" For example, PHP 4.0 is now at 4.01p2 (version .01, patch level 2) because of bugs found in release.0. I fully expect IMP 2.2 will go through similar revisions. My experience indicates that a release of .02 (IE: 4.02) is the first release anyone should install of any software package on a production server.
The versions of IMP and PHP we are using represent the most stable and most secure versions available. They are the best candidates for providing a good level of service with the least amount of trouble.
Configuring the Program
Strictly speaking, IMP is not compiled. The horde libraries are configured based on the type of database used, among other things. Three ways to install IMP are available. These are the totally manual way, the script way, and the Web page way.
The Web page way uses PHP to do the configuration and builds the libraries with changes. That is the way we will do it.
Installing IMP
Horde comes with a setup.php3 Web page. This page is defaulted to not be readable so that no one can modify your IMP settings. The creator of the Web-based setup script has provided an easy way to get the ball rolling. From a command prompt, change to the horde directory, and run the install.sh script:
[root@wmaxlaptop horde]# cd /home/httpd/html/horde/ [root@wmaxlaptop horde]# sh ./install.sh
Output
Your blank configuration files have been created, please go to the configuration utitlity at : your install path url/setup.php3
This shell script sets up a default system that is mostly blank. No database support is provided. To finish setting up horde, you need to run the Web page setup script. You can run the setup script using lynx, Netscape, or Internet Explorer.
To use lynx in an xterm , enter the following
[root@wmaxlaptop net]# lynx http:// lin /horde/setup.php3
(where //lin is the Web server name .)
I will show you the pages as we go. In many cases, only the relevant part of the screen will be printed. Lynx often gives helpful instructions at the bottom of the Web page it is displaying.
EXCURSION: IP Addresses and Traveling ComputersI move between networks on a daily basis. Each location provides me with different IP addresses for my machine and different machine names . Because of the problems associated with my IP address changing, I decided to give myself a private IP address that was not on any of the networks and did not share any characteristics with those networks. To that end, I chose 192.168.1.66 for my machine. When I hook up a Windows machine on the same network, I have to give it a 192.168.1.x address to let it talk to my Linux machine. I chose 192.168.1.70 for that machine. I modified my /etc/ hosts file to reflect the 192.168.1.x private addresses. If you take this approach, be sure to modify your Windows hosts file also. Speaking from experience, this can be a perplexing problem. To make things easier for me during my network changes, I created a set of scripts. These scripts are placed in a directory named net/, in root's home directory. Only root can run these scripts. The basic script looks like the following: #!/bin/bash ifdown eth0 cp -f /root/net/clog/network /etc/sysconfig/network cp -f /root/net/clog/ifcfg-eth0 /etc/sysconfig/network-scripts cp -f /root/net/clog/resolv.conf /etc ifup eth0 route add default gw 172.16.1.1 rm -f core In the clog/ directory, I have modified copies of the files that control network configuration. These files come from the /etc/sysconfig/ directory. By executing the ifdown program, the ethernet card driver is turned off, and its IP address is removed. When the ifup program is executed, the new IP address is activated. The default gateway must be set up again, because it was typically removed during the process. It is much faster running a script than rebooting. Linux shines in such areas. |
If you are running the lynx browser, it will ask you to allow a cookie. Indicate yes:
lin cookie: chuckmIMPlang=en Allow? (Y/N/Always/neVer)Y
The configuration Web page is brought up. It asks you for the default language (see Figure 6.2).
Figure 6.2. IMP Web-based setup, Step 1.
In my case, the default language is English. Currently, Brazilian
Portuguese, German, French, Italian, and Slovak are supported through a drop-down menu. Choose your language and click the Next button.
NOTE
As you can tell, you have several languages to choose from. I recommend that you start with English because that is the de facto language of the Internet. The other languages are always available to the user, and the user can customize the language for his or her logon.
If you decide to leave the language as is, you can use the left arrow key to escape from this list. Use the down arrow key or tab key to move from one field to another.
On the next page, you are asked to enter the server name. It picks up the Web server name from the Server Name field in the /etc/httpd/httpd.conf file (see Figure 6.3).
Figure 6.3. IMP Web-based setup, Step 2.
In my case, the server name is perfectly acceptable. This name will resolve back to the Web server with no problems on my test network. On the Internet, this should be the fully qualified domain name of your server. For example, assuming your machine name was mail, and your domain name was domain.com, the Local Server Name entry would be mail.domain.com. You can use the backspace key to erase the characters . Select the Next button. You will see the screen shown in Figure 6.4.
Figure 6.4. IMP Web-based setup, Step 3.
This part is very interesting. You are allowed to change the Root Base URL. However, I have found that if you do that, many things within the PHP scripts must be changed. My first attempt at doing this failed, and I did not have enough time to go through all the scripts and fix it. Keep the defaults in this screen for this installation. Click the Next button. You will see the screen shown in Figure 6.5.
Figure 6.5. IMP Web-based setup, Step 4.
The first editable field is the default IMAP server. Because IMP will be running on our local machine, the localhost entry is acceptable. You can point it to some other server on your network. If you give the user the ability to change IMAP servers, this entry will show up in that field as the default choice.
The next field is the default from address that is appended to the user's name. In my case it is lin, and because the hosts files on all my machines understand lin, it works. For a machine on the Internet, it would be the Internet domain name. If your machine name is lin and your domain is mydomain.com, you enter lin.mydomain.com.
The default IMAP port is just fine as is. All requests for IMAP service are made to this port.
For this installation, the Cyrus IMAP server is not available. You will skip all of those fields.
The Mail Folder Configuration is acceptable. All mail will be stored in the user's home directory, under the directory named Mail. Within that folder, other folders or files will be created for the inbox, sent mail, saved mail, and so forth.
You should not allow IMAP to subscribe for now. You need to have full control over adding users to your system. You must, as root, add a user to the system before that user can access email through IMP.
EXCURSION: Adding a User to Red Hat LinuxFor someone to log on to the IMP system, they must be entered as a user in your system. However, when you do that, you open up some possible security holes. In the following, I address adding users and small steps in securing your box to prevent the casual crack attempt from being successful. The process for adding a user is simple. First, log on as root. Run the command adduser with the user's logon name. You can also use linuxconf to add the user. For security reasons, you will want to do a modification to the standard add-user process under Red Hat. Whenever a user is created, that user's home directory is made. The files in the /etc/skel directory are copied into his home directory. By default, any user is allowed to telnet into your system if the network or IP addresses is allowed in /etc/hosts.allow or not denied in /etc/hosts.deny. You can circumvent this by setting the user's shell to be /dev/ null, rather than the default /bin/bash. This is inconvenient, and might not protect you from a cracker. I edit /etc/skel/.bash_profile and place the word exit at the end of the file. Whenever a user logs in, the shell is immediately exited. I have not found a way of bypassing this process, so it appears to be quite safe. To allow a user to telnet in, simply edit the .bash_profile in the user's directory and remove the exit line. After you have added the user as root, change into the user's directory and run chown root .bash* to cause the bash profile files to be owned by the root user. This prevents a user with FTP access from overwriting that file and providing unwanted access. This simple modification has saved me some grief . A few years ago a buffer overflow was in bind that allowed a cracker to execute arbitrary commands on my system. The cracker deleted /etc/hosts.deny. Then the cracker created user rewt using adduser, and gave that user superuser privileges. The cracker then used telnet to log on to the machine. The cracker was immediately logged out, and did not come back. I found the evidence in the logs the next day. I cleaned up and used the chattr +i /etc/hosts.deny command to make /etc/hosts.deny undeletable without the extra step of running chattr again. The point of this story is that crackers typically are running scripts that expect the system to be in a default condition. I would estimate about 90% of the newly installed systems are in that state. If you provide a few simple hurdles to cracking, you will protect your system from all but the most determined crackers. You should note that if a cracker really wants to own your system, he generally can. However, much greener pastures are out there with less expenditure of effort. Your job is to make things as inconvenient as possible for the cracker. This generally makes it inconvenient for you, too. |
The show dot files is a switch that allows the user to see normally invisible files in a directory. For security purposes, this should be set to False.
Unless you have problems with disk storage space, allow the user to save sent mail. This provides a level of convenience similar to Microsoft Exchange.
The next screen configures cookies (see Figure 6.6).
Figure 6.6. IMP Web-based setup, Step 5.
Web servers use cookies to give the user a contextually correct browsing session. From the Web server's point of view, every time a Web browser asks it for a page, it is the first time it has ever talked to that browser. Cookies were designed to allow the Web server to keep information about what the current user is doing, or has done in the past. All cookies have a timeout value. This value determines how long the information the cookie carries will be valid. It can make the cookie rather permanent. Generally, the timeout value is in seconds.
NOTE
Web browsers know what time it is based on the clock of the computer on which they are running. If the clock is too far off the clock on the Web server, cookies can expire early.
Some problem users have with IMP can be traced to their computer's clock being too far off the Web server clock.
The correct action to take is to correct the clock of the computer running the Web server. However, this is not always possible.
You can make this less of a problem by increasing the cookie time out in the Cookie Timeout field. I recommend keeping this at 10,000 for now, but increase it to 100,000 (or more) if you have users who can't set their clock to the correct time of day.
The screen shown in Figure 6.7 allows you to point to helper programs.
Figure 6.7. IMP Web-based setup, Step 6.
Screen 6 shows the external binaries that IMP needs to execute to do its job. The default Red Hat installs include ispell , tar, and sendmail. The IMP setup program does a very good job of locating these executables. You absolutely need sendmail. If you want to spell check the words in an outgoing email, you need ispell. Tar is used in some cases to package files for distribution. The mswordview package is not a necessity, but you should obtain it and install it if at all possible. It makes viewing email produced by Microsoft products a little easier.
The screen shown in Figure 6.8 gives you control over what the user can modify.
Figure 6.8. IMP Web-based setup, Step 7.
The Change Server entry allows the user to pick an IMAP server to log on to. That server can be anywhere on the Internet. You should set this to False. With the Change Folder entry, the user can pick a different directory in which to store the email. This should remain False.
NOTE
Allowing the user to set the IMAP server can present a security risk if you are connected to the Internet. A user can try to log on to an IMAP server elsewhere on the Internet. This could be used illegally to gain access to other people's mail if a person guesses an account and password.
The probability of this is rather low. However, in today's environment, you must examine all security issues and determine if the risks are acceptable. I recommend you do not allow the user to enter the IMAP server.
If you can trust your users, you can allow them to indicate the email is from someone else. This is a security issue that you must carefully consider. It allows people to generate UCE or anonymous email that is difficult to trace to the individual that sent it. It should be set to False for most systems, which disallows this modification.
In some cases a user can be allowed to change their from address on their email. If they are using a temporary account, or it is a roving accessible mailbox, their mail might need to appear to be from their home box. This is a judgment call, and one bad apple spoils the entire barrel.
The Change Full Name entry, if True, allows users to hide their given name. This is usually safe to allow.
The Use LDAP Search can safely remain False. It allows people to search LDAP servers for addresses.
If you set the Use Address Book to True, the user can administer private address book entries. These entries are stored in the MySQL server IMP tables previously set up. This is a useful service.
Next comes the email notification screen shown in Figure 6.9.
Figure 6.9. IMP Web-based setup, Step 8.
With this screen, you enable the ability to open a window telling the user new mail has arrived. The default is to check once every 10 minutes. The user is then able to keep a Web browser open and minimized, and not miss new mail. The default settings are generally acceptable.
The next screen, shown in Figure 6.10, allows some advertising features.
Figure 6.10. IMP Web-based setup, Step 9.
Using the features on this screen, you can include hidden and visible messages in each message sent from the system. The hidden parts are the X mailer directives, and go in the front of the message using the header.txt file. (You can put a visible header by not making it an X directive.) The visible message will go in the trailer.txt file. It is best to keep these options False for now. Feel free to experiment with them after you have the system working.
The MIME text view should be left True. It allows Internet Mail Extension text to be viewed in the email text display window in your Web browser. You can play with this setting later and see if the effects are to your liking.
EXCURSION: Additional Security SettingYou can use the header.txt file to provide additional security features. The default entry in that file contains the following line: X-Originating-IP: %REMOTE_ADDR% This line will cause the PHP interpreter to put the IP address of the machine that is connecting to the Web server in the outgoing message as an X directive. This could allow you to cross check with your logs to determine which machine sent an email. For security reasons, this would be a good feature to enable. I recommend you wait until IMP is working, and then enable it. |
Now we have the database screen shown in Figure 6.11.
Figure 6.11. IMP Web-based setup, Step 10.
The database screen connects IMP's PHP scripts to the correct database. Change the Use Database entry to True. Move to the Database Type field, and change it to Mysql. In Chapter 3, "MySQL," you set up the impmgr user with a password of impmgr. Enter these values in the User Name and Password. The default entries for the Server Name and tables are correct and can be left as is.
The PHP script then generates the setup file it will write and displays the file for your approval, as partly shown in Figure 6.12.
Figure 6.12. IMP Web-based setup, Step 11.
The entire contents of the file are listed following, as printed by the lynx browser:
Output
IMP Setup Program - IMP Setup Wizard Step ( 11 of 12 ) (p1 of 5) IMP IMP Setup Wizard Step ( 11 of 12 ) Confirm File Write - This is what your defaults.php3 will look like. : <?php /* file: defaults.php3 */ /* setup.php3 by Jason "ZeroDiVide" Orcutt < zerodiv@atcjet.net > */ /* For debugging purposes */ $default->error_level = 15; /* The longest that things like file uploads and slow functions */ /* should be allowed to run. 0 means run until termination */ /* (forever if infinite loop). */ /* NOTE: you can't set this to 0 if safe_mode is on. */ $default->max_execution_time = 0; /* Server Specific Configuration */ $default->localhost = 'lin'; /* Web Server Configuration */ $default->root_url = '/horde/imp'; $default->include_dir = './templates'; $default->graphics_url = '/horde/imp/graphics'; /* Default IMAP Server Configuration */ $default->server = 'localhost'; $default->from_server = 'lin'; $default->port = '143'; /* Default IMAP Folder Configuration */ $default->folders = 'mail/'; $default->use_imap_subscribe = false; $default->show_dotfiles = false; $default->save_sent_mail = true; $default->sent_mail = 'sent-mail'; $default->postponed = 'postponed'; /* Allow caching of the pages */ $default->cache_pages = false; /* Ldap searching */ $default->use_ldap_search = false; /* Server list : user is presented with a list */ /* of available imap servers */ $default->use_server_list = false; /* User changeable items */ $default->user_change_server = false; $default->user_change_folder = false; $default->user_change_from = true; $default->user_change_fullname = true; $default->user_use_addressbook = true; /* Check For New Mail Configuration */ $default->newmail_popup = true; $default->refresh_delay = '600'; /* Cookie Configuration */ $default->cookie_timeout = 10000; $default->session_enabled = 0; $default->session_timeout = '10000'; /* External Binaries Configuration */ $default->path_to_sendmail = '/usr/sbin/sendmail'; /* Sendmai l */ $default->path_to_ispell = '/usr/bin/ispell'; /* ISpell * / $default->path_to_mswordview = '[ NOT FOUND ]'; /* M$WordView */ $default->path_to_tar = '/bin/tar'; /* Tar */ /* SSL Configuration */ $default->secure = true; /* Cyrus Configuration */ $default->personal_folders = ''; /* i.e. INBOX. */ /* Default Language Configuration */ $default->language = 'en'; /* Message Configuration */ $default->append_header = false; $default->append_trailer = false; /* Text Viewing */ $default->text_parts_inline = true; /* Database Configuration */ $default->use_db = true; $default->database_driver = 'mysql'; $default->db_user_name = 'impmgr'; $default->db_password = 'impmgr'; $default->db_name = 'imp'; $default->db_server_name = 'localhost'; $default->db_pref_table = 'imp_pref'; $default->db_address_table = 'imp_addr'; $default->db_connect_string = ''; $default->db_server_port = ''; $default->db_server_options = ''; $default->db_server_tty = ''; ?> <-- Back Write File-->
Check these settings carefully. If you like them, click the Write File button, which is at the bottom of the Web page. The screen shown in Figure 6.13 will appear.
Figure 6.13. IMP Web-based setup, Step 12.
Now you must disable the setup script as instructed by the Web page. In an xterm window, change to the horde directory, and run the secure.sh script:
[root@wmaxlaptop root]# cd /home/httpd/html/horde/ [root@wmaxlaptop horde]# sh ./secure.sh
Output
I have made your configuration files, and libraries mode 0555 which is read / execute for everyone. And the setup.php3 is mode 0000 which is no access period.
We need to do a couple of things to the configuration file to make the IMP installation complete. First, edit /usr/local/lib/php3.ini, and look for magic_quotes_gpc. Change the settings for all magic_quotes to Off. In the standard PHP installation, only magic_quotes_gpc is On, as shown by this listing:
Output
;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; magic_quotes_gpc = Off \ ; magic quotes for incoming GET/POST/Cookie data magic_quotes_runtime = Off \ ; magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc. magic_quotes_sybase = Off \ ; Use Sybase-style magic quotes (escape ' with '' instead of \')
The last change is done for esthetic reasons. I don't really want people to have to remember to enter http://lin/horde/imp to get to their email. So I edited the /etc/httpd/conf/httpd.conf file, and found the aliases section by searching for Alias. I entered one line there:
Alias /webmail "/home/httpd/html/horde/imp"
I then restarted the httpd server, and logged in to http://lin/webmail. The IMP server screen shows up! The Webmail URL is much easier to remember.
The installation of IMP is complete. If you can't get the IMP Web page to show, skip to the troubleshooting section. Some of my trials and tribulations are documented there.
| only for RuBoard - do not distribute or recompile |
