{"id":13000,"date":"2023-12-30T14:34:19","date_gmt":"2023-12-30T19:34:19","guid":{"rendered":"https:\/\/myriad.ca\/?p=13000"},"modified":"2025-01-07T13:27:04","modified_gmt":"2025-01-07T18:27:04","slug":"how-to-install-carbonio-ce-on-ubuntu-20-04-a-complete-guide","status":"publish","type":"post","link":"https:\/\/myriad.ca\/index.php\/2023\/12\/30\/how-to-install-carbonio-ce-on-ubuntu-20-04-a-complete-guide\/","title":{"rendered":"How to Install Carbonio CE on Ubuntu 20.04 &#8211; A Complete Guide"},"content":{"rendered":"[vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221; gradient_type=&#8221;default&#8221; shape_type=&#8221;&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; column_position=&#8221;default&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][vc_column_text]Now that Synacor has decided to <span style=\"text-decoration: underline;\"><a href=\"https:\/\/forums.zimbra.org\/viewtopic.php?t=71903\" target=\"_blank\" rel=\"noopener\">stop supporting Zimbra OSE<\/a><\/span> it is time to move over to <span style=\"text-decoration: underline;\"><a href=\"https:\/\/zextras.com\/carbonio-community-edition\" target=\"_blank\" rel=\"noopener\">Carbonio CE<\/a><\/span> for my mail server needs. I have looked at many alternatives, but Carbonio is the closest thing out there and as it is built mainly on Zimbra to begin with, it should fit my needs for the time being. While it still has a way to go feature-wise (it&#8217;s gui could use some improvement and added features for example) on the plus side, it <em>is<\/em> under active development and while the support community on Carbonio&#8217;s forums is still sparse it should improve as more people move over from the Zimbra product.<\/p>\n<p>Now while there are a few how-to posts out on the web for installing Carbonio CE I&#8217;ve found many of them don&#8217;t work properly or the instructions are incomplete and produce a broken server. So having tried <em>all<\/em> of the available instructional posts and experiencing many failed installs, I decided to publish this complete guide. Though your mileage may vary depending on your system, this\u00a0 guide will at least get you a working mail server.<\/p>\n<p>The system I am installing on resides on a TrueNas server in a Byhve virtual Ubuntu machine with 12GB of ram,\u00a0 two Virtual CPUs, two Cores, two Threads and the Boot Loader set to UEFI. This guide will assume you know how to create a VM and can set up your network etc. When you install Ubuntu, set your swap file to match the size of your ram as I have found Carbonio CE likes to load up the swap file and the default 4GB will be insufficient. I also like to create two volumes inside a carbonio dataset: carbonio_root &amp; carbonio_data (which I mount on the new VM as \/opt). On install, I gave my host name as &#8220;mail&#8221; and most of the steps I &#8220;sudo su&#8221; to &#8220;root&#8221; as it&#8217;s easier when you are installing a lot of stuff at the same time.\u00a0 Notice the naming conventions in the prompts below. If you see: &#8220;root@mail:~$&#8221; I am root and &#8220;zextras@mail:~$&#8221; or &#8220;zimbra@mail:~$&#8221; I am the zextras user or zimbra user respectively.<\/p>\n<p>&nbsp;<\/p>\n<h3 style=\"text-align: center;\"><span style=\"text-decoration: underline;\">Summary<\/span><\/h3>\n<ul>\n<li><a href=\"#part_one\">Part One &#8211; Prepare Your VM&#8217;s Environment<\/a>\n<ul>\n<li><a href=\"#part_one\">Install Webmin<\/a><\/li>\n<li><a href=\"#Install_DNSMasq\">Install DNSMasq<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#Install_Carbonio\">Part Two &#8211; Install Carbonio<\/a>\n<ul>\n<li><a href=\"#Configure Carbonio\">Configure Carbonio CE<\/a><\/li>\n<li><a href=\"#Install_Firewall\">Install Firewall<\/a><\/li>\n<li><a href=\"#Install_Fail2Ban\">Install Fail2Ban<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#Part_Three\">Part Three &#8211; Migrate data from Zimbra to Carbonio CE<\/a>\n<ul>\n<li><a href=\"#Z2C\">Transfer the Z2C account data<\/a><\/li>\n<li><a href=\"#Import_Mailboxes\">Import Mailboxes from Zimbra to Zextras<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#Part_Four\">Part Four &#8211; Set Up LetsEncrypt &amp; DKIM for your Carbonio Domains<\/a>\n<ul>\n<li><a href=\"#Issue_certs\">Issue certs for your domains<\/a><\/li>\n<li><a href=\"#Setup_DKIM\">Set up DKIM \u00a0for Incoming E-mails in Carbonio CE<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#Part_Five\">Part Five &#8211; Backing up Carbonio CE<\/a>\n<ul>\n<li><a href=\"#Restore_MB\">Restore mailbox<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#Part_Six\">Part Six &#8211; How to Update Carbonio CE<\/a><\/li>\n<li><a href=\"#Part_Seven\">Part Seven &#8211; Backing up Carbonio CE backup to Cloud Storage with Restic<\/a><\/li>\n<li><a href=\"#Troubleshooting\">Troubleshooting and Useful Resources<\/a><\/li>\n<\/ul>\n<h3 id=\"part_one\"><span style=\"text-decoration: underline;\"><strong>Part One &#8211; Prepare Your VM&#8217;s Environment:<\/strong><\/span><\/h3>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704232234483{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;800&#8243;]<strong>Note:<\/strong> Re: Webmin and SSH access. I love Webmin as it&#8217;s super handy and I always install it on <em>all<\/em> my VMS. I used to use Putty a lot for ssh access but then I discovered <span style=\"text-decoration: underline;\"><a href=\"https:\/\/devolutions.net\/remote-desktop-manager\/\" target=\"_blank\" rel=\"noopener\">Remote Desktop by Devolutions<\/a><\/span>. It&#8217;s an amazing piece of console software for Windows, it&#8217;s free and I challenge ANYONE out there to show me a better product! Check it out, you&#8217;ll never go back to using anything else after you try Remote Desktop![\/vc_column_text][vc_column_text css=&#8221;&#8221; text_direction=&#8221;default&#8221;]\n<div>\n<ol>\n<li><strong>Install webmin<br \/>\n<\/strong>Add webmin repository:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ nano \/etc\/apt\/sources.list<\/pre>\n<p>Add the webmin repository info to bottom of &#8220;\/etc\/apt\/sources.list&#8221; and save:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">deb http:\/\/download.webmin.com\/download\/repository sarge contrib<\/pre>\n<p>Add key:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ wget -q -O- http:\/\/www.webmin.com\/jcameron-key.asc | sudo apt-key add\r\nroot@mail:~$ sudo apt update\r\nroot@mail:~$ sudo apt install webmin<\/pre>\n<\/li>\n<li>Install Perl socket6 &#8211; useful for when Carbonio get&#8217;s its IPV6 act together:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ apt-get install libsocket6-perl<\/pre>\n<\/li>\n<li>Switch webmin port to 10100 and use Webmin to update system packages<br \/>\nNote: Unfortunately,\u00a0 Carbonio ALSO uses port 10000 (and 10001 as well) for their admin GUI (why I do not know, since webmin has been using that port forever?!) so we need to switch webmin&#8217;s port.<br \/>\n<div class=\"divider\"><\/div><\/li>\n<li>Assign static IPV$ &amp; IPV6 IP address to zextras server through Netplan:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ cd \/etc\/netplan\r\nroot@mail:~$ nano your.yaml<\/pre>\n<p>Hint: I use my DHCP server to auto assign static ipv4\/6 to all my VM&#8217;s.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\"># This is the network config written by 'subiquity'\r\nnetwork:\r\n  ethernets:\r\n    enp0s4:\r\n      dhcp4: true\r\n      dhcp6: true\r\n  version: 2<\/pre>\n<p>Apply your changes:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:netplan apply<\/pre>\n<\/li>\n<\/ol>\n<\/div>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704151542013{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;800&#8243;]\n<h3><span style=\"color: #000000;\"><strong>***STOP HERE AND SNAPSHOT!!!***<\/strong><\/span><\/h3>\n[\/vc_column_text][vc_column_text]\n<ol start=\"5\">\n<li>Now it&#8217;s time to shut down the VM and snapshot the install so far. Call it &#8220;clean_install&#8221; or something like that. If anything goes wrong or you make an error,\u00a0 you can return to this point without having to start from scratch.<\/li>\n<li>Set machine hostname and host file information:<br \/>\nEven though you set the hostname in Ubuntu&#8217;s install setup, it never hurts to double check.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ hostnamectl set-hostname mail<\/pre>\n<p>Adjust networking &gt; networking configuration &gt;hosts in Webmin as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nameserver 127.0.0.1\r\nnameserver 9.9.9.9\r\nsearch mail.yourdomain.ca<\/pre>\n<p>Make sure \/etc\/hostname file looks like:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">127.0.0.1 localhost.localdomain localhost\r\n\"servers private IP\" mail.yourdomain.ca mail<\/pre>\n<\/li>\n<li id=\"Install_DNSMasq\">Install dnsmasq:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ apt-get install dnsmasq<\/pre>\n<p>Modify dnsmasq.conf:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\"># ###################################\r\n# BEGIN CARBONIO SERVER DNSMASQ CONFIG\r\n# ###################################\r\n#\r\n# Name Servers to use for resolution:\r\n# IP addresses below are for Google's public DNS servers;\r\n# you may wish instead to use your ISP's upstream servers,\r\n# or your AD servers with the DNS Role installed.\r\n# What's my Zextras server's domain?\r\ndomain=yourdomain.ca\r\n#\r\nmx-host=yourdomain.ca,mail.yourdomain.ca,5\r\n#\r\n# Only localhost can talk to me (Zextras Default).\r\n# Add this server's RFC1918 IP address if you want\r\n# other Zextras servers on the network to query me.\r\nlisten-address=127.0.0.1\r\n#\r\n# DNS A Record-Equivalent(s) go here:\r\naddress=\/mail.yourdomain.ca\/10.40.10.51\r\n#Needed for import\/export\r\naddress=\/yourdomain.ca\/10.40.10.51\r\n#\r\n#\r\n# DNS PTR Record-Equivalent(s) go here:\r\nptr-record=51.10.40.10.in-addr.arpa,mail.yourdomain.ca\r\n#\r\n# DNS MX Record-Equivalent(s) go here:\r\nsrv-host=_autodiscover._tcp.yourdomain.ca.,mail.yourdomain.ca.,443\r\n#\r\n# Increase the number of host lookups cached from the default 150\r\ncache-size=9500\r\n#\r\nbind-interfaces\r\n# ###################################\r\n# END CARBONIO SERVER DNSMASQ CONFIG\r\n# ###################################<\/pre>\n<p>Enable dnsmaq:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ systemctl enable dnsmasq\r\nroot@mail:~$ systemctl restart dnsmasq<\/pre>\n<\/li>\n<\/ol>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704151722197{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;800&#8243;]\n<h3><span style=\"color: #000000;\"><strong>***STOP HERE AND SNAPSHOT!!!***<\/strong><\/span><\/h3>\n[\/vc_column_text][vc_column_text]\n<ol start=\"8\">\n<li id=\"Install_DNSMasq\">Shut down VM and snapshot again. Call the snap &#8220;before Carbonio&#8221;:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ poweroff -f<\/pre>\n<p>Test DNS using host command:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ dig yourdomain.ca mx<\/pre>\n<p>You should see results similar to the following:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">; &lt;&lt;&gt;&gt; DiG 9.16.1-Ubuntu &lt;&lt;&gt;&gt; yourdomain.ca mx\r\n;; global options: +cmd\r\n;; Got answer:\r\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 28032\r\n;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2\r\n\r\n;; OPT PSEUDOSECTION:\r\n; EDNS: version: 0, flags:; udp: 1232\r\n;; QUESTION SECTION:\r\n;yourdomain.ca.                     IN      MX\r\n\r\n;; ANSWER SECTION:\r\nyourdomain.ca.              0       IN      MX      5 mail.yourdomain.ca.\r\n\r\n;; ADDITIONAL SECTION:\r\nmail.yourdomain.ca.         0       IN      A       10.40.10.51<\/pre>\n<p>Ensure your hostname is returned correctly:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ host $(hostname)<\/pre>\n<p>You should see your private IP returned like so:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">root@mail:~$ mail has address 10.40.10.51<\/pre>\n<\/li>\n<\/ol>\n[\/vc_column_text][vc_column_text css=&#8221;&#8221; text_direction=&#8221;default&#8221;]\n<h3 id=\"Install_Carbonio\"><span style=\"text-decoration: underline;\"><strong>Part Two &#8211; Install Carbonio:<\/strong><\/span><\/h3>\n<ol>\n<li>Add zextras repository. Download the following script using:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ wget https:\/\/repo.zextras.io\/inst_repo_ubuntu.sh<\/pre>\n<p>Give the script execution rights:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ chmod +x inst_repo_ubuntu.sh<\/pre>\n<p>Execute the script:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ .\/inst_repo_ubuntu.sh<\/pre>\n<p>Update &amp; upgrade repository database<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ apt update -y<\/pre>\n<\/li>\n<li>Install Carbonio CE packages:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ apt install service-discover-server carbonio-directory-server carbonio-proxy carbonio-webui carbonio-files-ui carbonio-admin-login-ui carbonio-mta carbonio-appserver carbonio-user-management carbonio-files-ce carbonio-files-db carbonio-storages-ce carbonio-preview-ce carbonio-docs-connector-ce carbonio-docs-editor carbonio-admin-ui carbonio-admin-console-ui postgresql-12 -y<\/pre>\n<\/li>\n<li id=\"Configure Carbonio\">Configure and launch Carbonio CE:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ carbonio-bootstrap<\/pre>\n<p>Set some options in the admin menu:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">set timezone option = 1 &gt; 6 = 37\r\napply config y<\/pre>\n<\/li>\n<li>Setup Carbonio Mesh &amp; pending setups:<br \/>\nCreate a password (mypassword) **store password somewhere as you <em>will<\/em> need it again for upgrading.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ service-discover setup-wizard *specify your internal ip of the server\r\nroot@mail:~$ pending-setups **a for all<\/pre>\n<\/li>\n<li>Configure Carbonio CE databases:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ su - postgres -c \"psql --command=\\\"CREATE ROLE carbonio_adm WITH LOGIN SUPERUSER encrypted password 'secretpw16charactersmax';\\\"\"\r\nroot@mail:~$ su - postgres -c \"psql --command=\\\"CREATE DATABASE carbonio_adm owner carbonio_adm;\\\"\"<\/pre>\n<p>You will see an output similar to this:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$PGPASSWORD=secretpw16charactersmax carbonio-files-db-bootstrap carbonio_adm 127.0.0.1<\/pre>\n<p>Restart CARBONIO:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ su - zextras\r\nroot@mail:~$ zmcontrol restart\r\nroot@mail:~$ zmcontrol -v<\/pre>\n<\/li>\n<li>Assign a password to the user zextras@carbonio.domain.tld\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ su - zextras\r\nzextras@mail:~$ zmprov setpassword zextras@yourdomain.ca mysecretpw<\/pre>\n<\/li>\n<li id=\"Install_Firewall\">Configure firewall:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ ufw status\r\nroot@mail:~$ ufw allow ssh\r\nroot@mail:~$ ufw allow 25,80,110,143,443,587,993,995,6071,8636,5222,10001,10100,10050\/tcp<\/pre>\n<\/li>\n<li id=\"Install_Fail2Ban\">Install Fail2ban:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ apt-get install fail2ban -y<\/pre>\n<p>Create the &#8220;\/etc\/fail2ban\/filter.d\/carbonio.conf&#8221; file and add:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">[Definition]\r\nfailregex = \\[ip=&lt;HOST&gt;;\\] account - authentication failed for .* \\(no such account\\)$\r\n            \\[ip=&lt;HOST&gt;;\\] security - cmd=Auth; .* error=authentication failed for .*, invalid password;$\r\n         ;oip=&lt;HOST&gt;;.* security - cmd=Auth; .* protocol=soap; error=authentication failed for .* invalid password;$\r\n         \\[oip=&lt;HOST&gt;;.* SoapEngine - handler exception: authentication failed for .*, account not found$\r\n         WARN .*;ip=&lt;HOST&gt;;ua=CarbonioWebClient .* security - cmd=AdminAuth; .* error=authentication failed for .*;$\r\n         NOQUEUE: reject: RCPT from .*\\[&lt;HOST&gt;\\]: 550 5.1.1 .*: Recipient address rejected:<\/pre>\n<p>Create the &#8220;\/etc\/fail2ban\/jail.local&#8221; file:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ nano \/etc\/fail2ban\/jail.local<\/pre>\n<p>*Add text below:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">[DEFAULT]\r\n# \"ignoreip\" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not\r\n# ban a host which matches an address in this list. Several addresses can be\r\n# defined using space separator.\r\nignoreip = 127.0.0.1\/8 10.40.10.0\/24 yourdomain.ca someip\/32 someip\/32 \r\n# \"bantime\" is the number of seconds that a host is banned.\r\nbantime = 600\r\n# A host is banned if it has generated \"maxretry\" during the last \"findtime\"\r\n# seconds.\r\nfindtime = 600\r\n\r\n# \"maxretry\" is the number of failures before a host get banned.\r\nmaxretry = 3\r\nbanaction = ufw\r\nbanaction_allports = ufw\r\n\r\n[ufw]\r\nenabled = true\r\nfilter  = ufw\r\nlogpath = \/var\/log\/ufw.log\r\n\r\n# Carbonio Jails.\r\n\r\n[carbonio-account]\r\nenabled = true\r\nfilter = carbonio\r\naction = iptables-allports[name=carbonio-account]\r\n#sendmail[name=carbonio-account, dest=zextras@domain.tld]\r\nlogpath = \/opt\/zextras\/log\/mailbox.log\r\nbantime = 600\r\nmaxretry = 5\r\n\r\n[carbonio-audit]\r\nenabled = true\r\nfilter = carbonio\r\naction = iptables-allports[name=carbonio-audit]\r\n#sendmail[name=Carbonio-audit, dest=zextras@domain.tld]\r\nlogpath = \/opt\/zextras\/log\/audit.log\r\nbantime = 600\r\nmaxretry = 5\r\n\r\n[carbonio-recipient]\r\nenabled = true\r\nfilter = carbonio\r\naction = iptables-allports[name=carbonio-recipient]\r\n#sendmail[name=Carbonio-recipient, dest=zextras@domain.tld]\r\nlogpath = \/var\/log\/carbonio.log\r\nbantime = 172800\r\nmaxretry = 5\r\n\r\n[postfix]\r\nenabled = true\r\nfilter = postfix\r\naction = iptables-multiport[name=postfix, port=smtp, protocol=tcp]\r\n#sendmail-buffered[name=Postfix, dest=zextras@domain.tld]\r\nlogpath = \/var\/log\/carbonio.log\r\nbantime = 172800\r\nmaxretry = 5\r\n<\/pre>\n<p>Save changes and restart Fail2ban:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ systemctl restart fail2ban<\/pre>\n<p>You can check the status of fail2ban using:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ fail2ban-client status carbonio-audit<\/pre>\n<\/li>\n<\/ol>\n<h3 id=\"Part_Three\"><span style=\"text-decoration: underline;\">Part Three &#8211; Migrate data from Zimbra to Carbonio CE:<\/span><\/h3>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704313552087{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;800&#8243;]<strong>Note: <\/strong>A few things you should keep in mind before starting the mailbox export\/import process:<br \/>\n* Set the socket timeout on both servers high.<br \/>\n* Check if you have any attachment limits. It&#8217;s a good idea to increase attachment size to 50 MB.[\/vc_column_text][vc_column_text]\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\n<li>Set timeout limits:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ zmprov mcf zimbraMtaMaxMessageSize 52428800<\/pre>\n<p>Check current timeout value:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ zmlocalconfig socket_so_timeout<\/pre>\n<p>Change this with higher value to avoid timeouts:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ zmlocalconfig -e socket_so_timeout=3000000\r\nzimbra@mail:~$ zmlocalconfig --reload<\/pre>\n<\/li>\n<li>Extract all user information from the old Zimbra server so we can create them on the new Carbonio server.<br \/>\nZ2C consists of a simple pair of scripts to export LDAP data from an original Zimbra or Carbonio server and import it on a brand new Zimbra or Carbonio server. It\u2019s goal is to migrate accounts and help to dump and restore mailboxes from one server to another.<br \/>\nLet&#8217;s install it:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ mkdir \/opt\/Z2C\r\nroot@mail:~$ mkdir \/opt\/Z2C\/data\r\nroot@mail:~$ wget https:\/\/www.anahuac.eu\/Z2C.tgz\r\nroot@mail:~$ tar xvf Z2C.tgz<\/pre>\n<p>Copy the files:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ cp Z2C\/* \/opt\/Z2C\/<\/pre>\n<p>Give the script execution rights:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ chmod +x \/opt\/Z2C\/z2c.sh<\/pre>\n<p>Change ownership<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ chown -R zimbra:zimbra \/opt\/Z2C\/<\/pre>\n<p>Execute the script as zimbra to export the data:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ su - zimbra\r\nzimbra@mail:~$ cd \/opt\/Z2C\r\nzimbra@mail:~$ .\/z2c.sh<\/pre>\n<\/li>\n<li id=\"Z2C\">Transfer the Z2C account data. In OLD Zimbra Server\u00a0run:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ rsync -auv -e \"ssh -C\" \/opt\/Z2C\/ root@new_server_ip:\/opt\/ *First time run or\r\nroot@mail:~$ rsync -auv -e \"ssh -C\" \/opt\/Z2C\/ root@new_server_ip:\/opt\/Z2C\/ *Subsequent copies<\/pre>\n<\/li>\n<li>Change timeout value back after export:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ zmlocalconfig -e socket_so_timeout=30000\r\nzimbra@mail:~$ zmlocalconfig --reload<\/pre>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<h4>Import User Data To the New Server<\/h4>\n<\/li>\n<\/ol>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704205782268{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;800&#8243;]\n<h3><span style=\"color: #000000;\"><strong>***STOP HERE AND SNAPSHOT!!!***<\/strong><\/span><\/h3>\n<p>Shut down VM and snapshot again. Call the snap &#8220;before carbonio import&#8221;[\/vc_column_text][vc_column_text]\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ poweroff -now<\/pre>\n<ol start=\"5\">\n<li>Import all transferred data into the new server using the following method. Restore all domains &amp; users, etc:<br \/>\n*Edit out spam and ham, galsync accounts out of mail and password files<br \/>\nUse a screen session because this could take a long time depending on no. of users, etc.:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ screen<\/pre>\n<p>*Tip: CTRL+a+d to exit screen session and leave it active.<br \/>\nRestore mailbox data:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ .\/restore.sh<\/pre>\n<\/li>\n<li>Import Mailboxes from Zimbra into Zextras.<br \/>\nSo far, we have exported all user information from the OLD server to the NEW server. So now we can change the necessary DNS records so that the NEW server can be the active email server. Change DNS records (on your firewall) to make the NEW server an active server. As soon as DNS records propagate, all users can log in to their email account using their existing credentials. But in their account, there will be no previous data. Now we will transfer email data to Carbonio.On OLD server:<br \/>\nWhen you first run Z2C you will notice it creates a full set of scripts in the Z2C\/export directory:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">script_export_FULL.sh -\u00a0 a list of zmmailbox commands to dump all mailboxes;\r\nscript_export_TRASH.sh -\u00a0 a list of zmmailbox commands to dump the Trash folder;\r\nscript_import_FULL.sh -\u00a0 a list of zmmailbox commands to restore all mailboxes;\r\nscript_import_TRASH.sh -\u00a0 a list of zmmailbox commands to restore the Trash folder;\r\nscript_import_quota.txt -\u00a0 a list of zmprov commands to restore all accounts quotas if you need it;\r\nusers.txt -\u00a0 show the list of users dumped from Zimbra server<\/pre>\n<p>We will use these scripts now to export mail off of the Zimbra server:<br \/>\nSwitch to a screen session:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ screen\r\nroot@mail:~$ su - zimbra\r\nzimbra@mail:~$ cd \/opt\/Z2C\/export\r\nzimbra@mail:~$ .\/script_export_FULL.sh<\/pre>\n<p>Exit screen and have a coffee:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ ctrl +ad\r\nroot@mail:~$ screen -r\r\nzimbra@mail:~$ .\/script_export_TRASH.sh<\/pre>\n<\/li>\n<li>Export to new server:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ rsync -auv -e \"ssh -C\" \/opt\/Z2C\/data root@new_server_ip:\/opt\/Z2C\/<\/pre>\n<\/li>\n<li>Import mail into CARBONIO<br \/>\nSwitch to a screen session:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ screen\r\nroot@mail:~$ su - zextras\r\nzextras@mail:~$ cd \/opt\/Z2C\/export\r\nzextras@mail:~$ .\/script_import_FULL.sh<\/pre>\n<p>Exit screen have a coffee<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ ctrl +ad\r\nroot@mail:~$ screen\r\nzextras@mail:~$ .\/script_import_TRASH.sh<\/pre>\n<p>If you get a timeout error (large mailboxes tended to timeout for me) use the following command:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ curl -k -H \"Transfer-Encoding: chunked\" -u admin:AdminPassword -T \/directory_backup_tgz\/your_username@your_domain.com.tgz -X POST\"https:\/\/localhost:6071\/service\/home\/your_username@your_domain.com\/?fmt=tgz&amp;resolve=skip\"<\/pre>\n<\/li>\n<\/ol>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704206016731{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;800&#8243;]<strong>Note:<\/strong> The only unfortunate thing about the timeout fix above is that you have to import each mailbox manually. It would be nice if Zextras offered the import\/export suite as an addon for Carbonio CE but they only offer it on their enterprise edition which starts at 150 mailboxes. Hopefully someone will update the Z2C export\/import script so that it exclusively uses the chunked method of importing. Granted, it&#8217;s much slower, but it works on large mailboxes and if you follow the instructions above it just means that it takes a bit more time for the users data to show up from the old server &#8211; not a deal killer. BTW, I had to use this method to import all my large mailbox accounts.[\/vc_column_text][vc_column_text]\n<ol start=\"9\">\n<li>Copy Users Filter Rules<br \/>\nExport existing filter user rules (from Zimbra) and save into a file:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ mkdir \/opt\/Z2C\/filters\r\nzimbra@mail:~$ cd\/opt\/Z2C\/filters\r\nzimbra@mail:~$ zmprov -l ga UserA@yourdomain.com zimbraMailSieveScript &gt; \/filters\/user.filter_rules.txt<\/pre>\n<p>Prepare the output file &#8220;\/tmp\/filter_rules.txt&#8221;<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ sed -i -e \"1d\" \/tmp\/filter_rules.txt\r\nzimbra@mail:~$ sed -i -e 's\/zimbraMailSieveScript: \/\/g' \/filters\/user.filter_rules.txt<\/pre>\n<p>Check required folders&#8217; path for the filter rules.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ cat \/filters\/user.filter_rules.txt | grep 'fileinto'<\/pre>\n<p>Example:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zimbra@mail:~$ cat \/tmp\/filter_rules.txt | grep 'fileinto'\r\nfileinto \"TestEmail\/TEST2\";\r\nfileinto \"User5\";\r\nfileinto \"Admin\";\r\n<\/pre>\n<p>Import prepared filter rules on another user. Copy the filters folder to \/opt\/Z2C\/ on the target server:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ cd \/opt\/Z2C\/filters\r\nzextras@mail:~$ zmprov ma UserB@yourdomain.com zimbraMailSieveScript \"`cat \/tmp\/filter_rules.txt`\"<\/pre>\n<\/li>\n<\/ol>\n<h3><span id=\"Part_Four\" style=\"text-decoration: underline;\">Part Four &#8211; Set Up LetsEncrypt &amp; DKIM for your Carbonio Domains:<\/span><\/h3>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704212245354{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;850&#8243;]\n<h3><span style=\"color: #000000;\"><strong>***STOP HERE AND SNAPSHOT BEFORE INSTALLING CERTS!!!***<\/strong><\/span><\/h3>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704227479691{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;850&#8243;]<strong>Note:<\/strong> I followed a bunch of \u201cHow to install LetsEncrypt for Carbonio\u201d guides and <em>none<\/em> of them worked for me. I also tried to use the Carbonio Certificate Installer GUI thingy, but it also does not work, especially when importing existing domains from a previous Zimbra install. The immortal Zimbra\/sysadmin expert, Jim Dunphy, has ported over a working <span style=\"text-decoration: underline;\"><a href=\"https:\/\/github.com\/JimDunphy\/acme.sh\" target=\"_blank\" rel=\"noopener\">Zimbra Letsencrypt<\/a><\/span> method\u00a0 which is described below.[\/vc_column_text][vc_column_text]\n<ol>\n<li>Install socat (needed for LetsEncrypt):\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ apt install socat<\/pre>\n<p>Temporarily change ownership on zextras folder (needed for installing LetsEncrypt)<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ chown zextras:zextras \/opt\/zextras\/\r\nroot@mail:~$ su - zextras\r\nzextras@mail:~$ wget -O - https:\/\/get.acme.sh | sh\r\nzextras@mail:~$ exit\r\nroot@mail:~$ chown root:root \/opt\/zextras\/<\/pre>\n<\/li>\n<li><a href=\"https:\/\/myriad.ca\/carbonio.zip\" target=\"_blank\" rel=\"noopener\">Upload &#8216;carbonio.sh&#8217;<\/a> to .acme.sh\/deploy directory:<br \/>\nFix permissions:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ chown zextras:zextras \/opt\/zextras\/.acme.sh\r\nroot@mail:~$ su - zextra\r\nzextras@mail:~$ cd ~\/.acme.sh\r\nzextras@mail:~$ acme.sh --upgrade<\/pre>\n<p>Add access keys to dns_aws.sh &amp; set LetsEncrypt as default<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ acme.sh --set-default-ca --server letsencrypt\r\nzextras@mail:~$ acme.sh --set-default-chain --preferred-chain ISRG --server letsencrypt<\/pre>\n<\/li>\n<li id=\"Issue_certs\">Issue certs for your domains:<br \/>\nNote: I am also using Route53 on AWS so I am able to automate dns verification (huge timesaver). Read <span style=\"color: #800080;\"><a style=\"color: #800080;\" href=\"https:\/\/github.com\/acmesh-official\/acme.sh\/wiki\/dnsapi\" target=\"_blank\" rel=\"noopener\">this link for more info<\/a><\/span> and a list of supported DNS providers. The example below shows my AWS (dns_aws) automated check:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ acme.sh --issue --keylength 2048 --dns dns_aws -d mail.yourdomain.ca -d mail.addnldomain1.com -d mail.addnldomain2.com -d mail.addnldomain3.ca<\/pre>\n<\/li>\n<li>Deploy your certificate:<br \/>\nNote: The example below uses Jim Dunphy&#8217;s deploy script which you can download by <span style=\"color: #800080;\"><a style=\"color: #800080;\" href=\"https:\/\/github.com\/JimDunphy\/acme.sh\/tree\/master\/deploy\" target=\"_blank\" rel=\"noopener\">clicking here<\/a><\/span>.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ acme.sh --deploy --deploy-hook carbonio -d mail.yourdomain.ca<\/pre>\n<p>View your deployed cert:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ zmcertmgr viewdeployedcrt<\/pre>\n<p>View Letsencrypt cert expiry:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ acme.sh --list<\/pre>\n<\/li>\n<li>Set up DKIM \u00a0for Incoming E-mails in Carbonio CE:<br \/>\nConfiguring DKIM for outgoing e-mail signing improves the credibility of your messages sent by users on your servers. This happens as the receiving server can validate your e-mail DKIM record. For that to happen, we need to configure OpenDKIM to sign outgoing e-mails. By configuring DKIM to check incoming e-mails any incoming e-mail that lacks domain keys is automatically rejected. To do so we configure the OpenDKIM to check incoming e-mails as follows:<br \/>\nEdit opendkim.conf:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ nano \/opt\/zextras\/conf\/opendkim.conf<\/pre>\n<p>Set the values for <strong>On-NoSignature<\/strong> and <strong>Mode<\/strong> respectively to &#8220;reject&#8221; and &#8220;sv&#8221;Restart the OpenDKIM service:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ su - zextras\r\nzextras@mail:~$ zmcontrol restart opendkimInstall the install libxml-simple-perl package:\r\nroot@mail:~$ apt-get install libxml-simple-perl\r\nroot@mail:~$ su - zimbra<\/pre>\n<p>Generate a DKIM key for your domain:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ \/opt\/zextras\/libexec\/zmdkimkeyutil -a -d example.tld<\/pre>\n<p>Understanding the Output:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">The Selector which is the string before ._domainkey, in our case 0E9F184A-9577-11E1-AD0E-2A2FBBAC6BCB,\r\nThe Version which is indicated with v= in our case v=DKIM1,\r\nThe Key type which is indicated with k= in our case k=rsa,\r\nThe Public key which is indicated with p= in our case p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY5CBg15nZ2vYnRmrNub6Jn6ghQ2DXQbQgOJ\/E5IGziUYEuE2OnxkBm1h3jived21uHjpNy0naOZjLj0xLyyjclVy1chrhSbsGAhe8HLXUsdXyfRvNTq8NWLsUnMEsoomtJCJ\/6LYWYU1whOQ9oKZVAwWHSovAWZpByqNMZmFg7QIDAQAB<\/pre>\n<p>Adding your DKIM data to the DNS:<br \/>\nNow it\u2019s time to add the DKIM data obtained in the previous section to your DNS. To do so, access your DNS provider, for example, GoDaddy, Network Solutions, etc. Access your DNS management based on your provider&#8217;s instructions.<br \/>\n&#8211; Add a new TXT entry setting Record Type as TXT.<br \/>\n&#8211; Insert your selector as yourSelector._domainkey in the Hostname field.<br \/>\n&#8211; Insert your version, key type, and public key, and separated them by ; like v=&#8230;;k=&#8230;;p=&#8230; in the TXT Value field.<br \/>\n&#8211; Assign the Time to Live (TTL), for example, let\u2019s use 3600s.<br \/>\n&#8211; Save the entry.<br \/>\nNote:If you use Route 53: You can&#8217;t paste the entire key in as you will get an error, the keys need to be split as indicated in the example below:<br \/>\nUse this key and paste it into notepad++ and match with the key output by the command above. Note where the <em>double quotes<\/em> are as this is the &#8216;split&#8217; point:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">\"v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAdfgrIIBCgKCAQEA6GFaC329i7DTkt02Dzclng9eyxBjxTkDucaCKZm3bw\/ovdk8UdDPAYUHiGW65TQ9KyszZPn8x9FnbYIAoYS6yoytWOQTgkOscT3yueCmb+Re0m87EhSMzOyEEKUjbnsKO3p7qVIE5+XgyYmCmt1\"\"pFSX0CAzzpSwIldt1FtyukEiRN7rDcw9SPBfRYYfRxARf3m8UCPmhcD0Ttgn+RgIfu90GvORhGmL73BByJJQO+87WhIEwZ7JlbXO9UyFLocuITl8\/UPi9H65urr7ONgBswzHvARD50pvPvDBgFXz3Yac0aLiqI+QxPLCQQLuYH6\/X0K1Cz0t7LtNc4UAgpozcHwIDAQAB\"<\/pre>\n<p>For more info <a href=\"https:\/\/community.zextras.com\/everything-you-need-to-know-about-dkim-for-your-carbonio-community-edition-servers\" target=\"_blank\" rel=\"noopener\">look here<\/a>.<\/li>\n<li>Update Carbonio RBL&#8217;s via zimbraMtaRestriction<br \/>\nCheck your existing settings as Zextras user:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ carbonio prov gcf zimbraMtaRestriction\r\nzimbraMtaRestriction: reject_invalid_helo_hostname\r\nzimbraMtaRestriction: reject_non_fqdn_sender\r\nzimbraMtaRestriction: reject_unknown_sender_domain<\/pre>\n<p>Modify with new settings (will overwrite old settings):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ carbonio prov mcf \\\r\nzimbraMtaRestriction reject_invalid_helo_hostname \\\r\nzimbraMtaRestriction reject_non_fqdn_sender \\\r\nzimbraMtaRestriction reject_unknown_sender_domain \\\r\nzimbraMtaRestriction reject_invalid_hostname  \\\r\nzimbraMtaRestriction \"reject_rbl_client cbl.abuseat.org\" \\\r\nzimbraMtaRestriction \"reject_rbl_client bl.spamcop.net\" \\\r\nzimbraMtaRestriction \"reject_rbl_client sbl.spamhaus.org\" \\\r\nzimbraMtaRestriction \"reject_rbl_client b.barracudacentral.org\"<\/pre>\n<p>Restart zmmtactl (will take a while, be patient):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ zmmtactl restart<\/pre>\n<\/li>\n<\/ol>\n[\/vc_column_text][vc_column_text]\n<h3 id=\"Part_Five\"><span style=\"text-decoration: underline;\"><strong>Part Five &#8211; Backing up Carbonio CE:<\/strong><\/span><\/h3>\n<p>It&#8217;s always a good idea to backup your mail in case of disaster. We will use cmbackup, which is a good start as an Open Source solution for backing up Carbonio mail. Cmbackup is still a bit of a work in progress, as it&#8217;s ported over from a similar Zimbra backup script but the author,\u00a0 <span style=\"text-decoration: underline;\"><a href=\"https:\/\/community.zextras.com\/participant\/anahuac\/\" target=\"_blank\" rel=\"noopener\">anahuac<\/a>,<\/span> is fairly responsive on the Zextras forums if you have issues. It&#8217;s unfortunate that Zextras has abandoned us &#8220;Suite&#8221; users, but hopefully they will re-introduce a Zextras Suite product for CE in the near future.<\/p>\n<ol>\n<li>Backup Carbonio with cmbackup<br \/>\nInstall needed packages:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ apt-get install parallel wget curl sqlite3<\/pre>\n<p>Download and install the latest cmbackup package:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:~$ cd \/opt\r\nroot@mail:~$ wget https:\/\/www.anahuac.eu\/cmbackup.tgz\r\nroot@mail:~$ cd cmbackup\r\nroot@mail:~$ .\/install.sh\r\nroot@mail:~$ su - zextras\r\nzextras@mail:~$ cmbackup -v\r\nzextras@mail:~$ cmbackup version: 1.2.6<\/pre>\n<p>***After install, <strong>disable cmbackup cron jobs while testing<\/strong>. If you re-install or update CMBackup, the program will incorrectly create duplicate cron jobs on re-installs or updates (bug). Make sure you delete those jobs from \/etc\/cron.d or the cron <em>won&#8217;t<\/em> run. I had to backup ALL mailboxes (can&#8217;t backup just one &#8211; won&#8217;t work &#8211; bug).<\/li>\n<li>Time to backup up your mailboxes:<br \/>\nTo backup all mail:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ cmbackup -f -m user@yourdomain.ca *actually backs up all mailboxes<\/pre>\n<p>To back up a user:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ cmbackup -r -m mbox-20231213110928 user@yourdomain.ca<\/pre>\n<p>To create an incremental backup:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ cmbackup -i<\/pre>\n<\/li>\n<li id=\"Restore_MB\">Restore mailbox:<br \/>\nList all backups and restore backup:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ cmbackup -l<\/pre>\n<p>You will get an output like this:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">+---------------------------+------------+----------+----------------------------+\r\n|       Session Name        |    Date    |   Size   |        Description         |\r\n+---------------------------+------------+----------+----------------------------+\r\n| full-20231227063546       | 12\/27\/2023 | 6.5G     | Full Backup                |\r\n| full-20231228013001       | 12\/28\/2023 | 6.5G     | Full Backup                |\r\n| full-20231229013001       | 12\/29\/2023 | 6.5G     | Full Backup                |\r\n| full-20231230013001       | 12\/30\/2023 | 6.5G     | Full Backup                |\r\n| full-20231231013001       | 12\/31\/2023 | 6.5G     | Full Backup                |\r\n| full-20240101013001       | 01\/01\/2024 | 6.5G     | Full Backup                |\r\n| full-20240102013001       | 01\/02\/2024 | 6.5G     | Full Backup                |\r\n| inc-20231227080001        | 12\/27\/2023 | 96K      | Incremental Backup         |\r\n| inc-20231227120001        | 12\/27\/2023 | 212K     | Incremental Backup         |\r\n| inc-20231227160001        | 12\/27\/2023 | 288K     | Incremental Backup         |\r\n| inc-20231227200001        | 12\/27\/2023 | 336K     | Incremental Backup         |\r\n| inc-20231228000001        | 12\/28\/2023 | 372K     | Incremental Backup         |\r\n| inc-20231228040001        | 12\/28\/2023 | 76K      | Incremental Backup         |\r\n| mbox-20180408160808\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0| 12\/28\/2023 | 40K\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0| Mailbox\u00a0                   |\r\n+---------------------------+------------+----------+----------------------------+\r\n<\/pre>\n<p>Restore a single user from the list above:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ cmbackup -r -m mbox-20180408160808 user@yourdomain.ca<\/pre>\n<p>Restore a domain:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ cmbackup -r full-20240102013001<\/pre>\n<\/li>\n<li>Now you need to set those jobs in cron to run daily or whatever frequency works for you. I do a full backup daily at 01:30 and incremental backups every four hours. Hint: Webmin is great for setting up those cron jobs.<\/li>\n<li>Pruning backups<br \/>\nWe need to delete old backups or they will eventually kill your system by filling up the \/opt partition. Use cmbackup like so to prune backup older than 5 days:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ cmbackup -hp 5 days<\/pre>\n<p>Add this to your cron job to run once overnight every day. I use: \/usr\/local\/bin\/cmbackup -hp 5 days in the cron job running as zextras user.<\/li>\n<\/ol>\n<h3 id=\"Part_Six\"><span style=\"text-decoration: underline;\"><strong>Part Six &#8211; How to Update Carbonio CE:<\/strong><\/span><\/h3>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1704230088643{margin-top: 10px !important;margin-right: 10px !important;margin-bottom: 10px !important;margin-left: 10px !important;border-left-width: 10px !important;padding-top: 5px !important;padding-right: 20px !important;padding-bottom: 5px !important;padding-left: 20px !important;background-color: #4bbdf2 !important;border-left-color: #ff0044 !important;border-left-style: solid !important;border-radius: 4px !important;}&#8221; max_width=&#8221;800&#8243;]\n<h3><span style=\"color: #000000;\"><strong>***STOP HERE AND SNAPSHOT YOUR SYSTEM!!!***<\/strong><\/span><\/h3>\n[\/vc_column_text][vc_column_text css=&#8221;&#8221; text_direction=&#8221;default&#8221;]Carbonio CE is not as easy to update as Zimbra and you need to follow the procedure carefully to avoid damaging your install. Also, these instructions are to be executed on each <strong>Node<\/strong>, be it the (single) Node in a Single-Server installation, or all the Nodes in a Multi-Server installation. Assuming you have created a snapshot here is the WORKING procedure.<\/p>\n<ol>\n<li>Check your Zextras services to ensure your system is running ok:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$ zmcontrol -v\r\nCarbonio Release 22.11.0\r\n\r\nzextras@mail:~$ zmcontrol status\r\nHost mail.example.com\r\n        amavis                  Running\r\n        antispam                Running\r\n        antivirus               Running\r\n        directory-server        Running\r\n        logger                  Running\r\n        mailbox                 Running\r\n        memcached               Running\r\n        mta                     Running\r\n        opendkim                Running\r\n        proxy                   Running\r\n        service webapp          Running\r\n        service-discover        Running\r\n        stats                   Running\r\n        zimbra webapp           Running\r\n        zimbraAdmin webapp      Running\r\n        zimlet webapp           Running\r\n        zmconfigd               Running<\/pre>\n<\/li>\n<li>Even though the Carbonio guide says to &#8220;Disable Carbonio cron jobs&#8221; I would suggest you ignore this directive as Carbonio will instantly re-create the disabled jobs, leaving you with tons of duplicates. What a mess!<\/li>\n<li>Make a dump of the LDAP Database, especially if the if the upgrade includes the Directory Server. This can be done as follows:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:$ su - zextras\r\nzextras@mail:$ mkdir \/opt\/update_bu\r\nzextras@mail:$ \/opt\/zextras\/libexec\/zmslapcat \/opt\/update_bu\/ldbackup\r\nextras@mail:$ cp \/opt\/zextras\/conf\/localconfig.xml \/opt\/update_bu\/<\/pre>\n<\/li>\n<li>Upgrade your server **<span style=\"color: #ff0000;\">Make sure all Carbonio services are running normally BEFORE you issue the update command<\/span>**. Important: Do not install these updates from the webmin UI!\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">zextras@mail:~$\u00a0zmcontrol\u00a0status\u00a0\r\nHost\u00a0mail.example.com\u00a0\r\n    amavis Running \r\n    antispam Running \r\n    antivirus Running \r\n    directory-server Running \r\n    logger Running \r\n    mailbox Running \r\n    memcached Running \r\n    mta Running \r\n    opendkim Running \r\n    proxy Running \r\n    service webapp Running \r\n    service-discover Running \r\n    stats Running \r\n    zimbra webapp Running \r\n    zimbraAdmin webapp Running \r\n    zimlet webapp Running \r\n    zmconfigd Running\r\nzextras@mail:$ exit\r\nroot@mail:$ apt update &amp;&amp; apt upgrade --fix-broken<\/pre>\n<\/li>\n<li>Bootstrap Carbonio Files database.<br \/>\nNote: Take a close at the list of packages that are going to be upgraded in this process. If it has any DB(-db) package in the upgrade list, then you need to bootstrap the corresponding database by running:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">PGPASSWORD=\"supersercret_16_character_password\" carbonio-files-db-bootstrap carbonio_adm 127.0.0.1<\/pre>\n<p>If you are having problems with Carbonio accepting your password, see Troubleshooting section below for reset instructions.<\/li>\n<li>Register upgraded packages to Carbonio Mesh:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">root@mail:$ pending-setups -a **Password=supersecretPW\r\nroot@mail:$ reboot<\/pre>\n<p>&nbsp;<\/li>\n<\/ol>\n[\/vc_column_text][vc_column_text]\n<h3 id=\"Part_Seven\"><span style=\"text-decoration: underline;\"><strong>Part Seven &#8211; Backing up Carbonio CE backup to the Cloud with Restic:<\/strong><\/span><\/h3>\n<p>Coming soon&#8230;[\/vc_column_text][vc_column_text]\n<h3 id=\"Troubleshooting\"><span style=\"text-decoration: underline;\">Troubleshooting tips<\/span><\/h3>\n<p><em>Still<\/em> not working as you expect? Check out the log files in your VM before you post a comment. Still not working, check your steps carefully, every command has to be issued as it is shown above.\u00a0 If you find any mistakes with this how-to please leave a comment below.<\/p>\n<h4>Problems and solutions<\/h4>\n<ul>\n<li>Check the <a href=\"https:\/\/community.zextras.com\/forum\/carbonio\/\" target=\"_blank\" rel=\"noopener\">Carbonio forums<\/a> as they are a good resource for common errors, etc.<\/li>\n<li>Carbonio not accepting your postgres password:<br \/>\nNote: When you first create your postgres (PG) password in the <em>initial install<\/em> the limit is 99 characters, but special characters like &#8220;=&#8221; will break the password in PG. As I used Bitwarden to generate the random password, I think that is what broke it for me. PG accepted the password and I stored it for future use, but when I tried to upgrade as per the above instructions I got an error. Most PG admins agree that a 16 character password is adequate (minus the bad special characters of course). See\u00a0<span style=\"text-decoration: underline;\"><a href=\"https:\/\/dba.stackexchange.com\/questions\/286254\/maximum-length-or-special-character-restrictions-for-postgresql-13-user-password\" target=\"_blank\" rel=\"nofollow noopener\">this post<\/a><\/span>\u00a0for more info.<br \/>\nIf you have issues with an incorrect or forgotten postgres password on upgrade here is how to reset it as root:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"postgresql\">sudo -u postgres psql\r\npostgres=# \\password carbonio_adm\r\nEnter new password for user \"carbonio_adm\":\r\nEnter it again:\r\npostgres=# \\q<\/pre>\n<\/li>\n<li>Here is a cmbackup command list for your reference:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">$ cmbackup -h\r\nusage: cmbackup -f [-m,-dl,-al,-ldp, -sig] [-d,-a] &lt;mail\/domain&gt;\r\n       cmbackup -i &lt;mail&gt;\r\n       cmbackup -r [-m,-dl,-al,-ldp, -sig] [-d,-a] &lt;session&gt; &lt;mail&gt;\r\n       cmbackup -r [-ro] &lt;session&gt; &lt;mail_origin&gt; &lt;mail_destination&gt;\r\n       cmbackup -d &lt;session&gt;\r\n       cmbackup -m\r\n\r\nOptions:\r\n\r\n -f,  --full                      : Execute full backup of an account, a list of accounts, or all accounts.\r\n -i,  --incremental               : Execute incremental backup for an account, a list of accounts, or all accounts.\r\n -l,  --list                      : List all backup sessions that still exist in your disk.\r\n -r,  --restore                   : Restore the backup inside the users account.\r\n -d,  --delete                    : Delete a session of backup.\r\n -hp, --housekeep                 : Execute the Housekeep to remove old sessions - Zmbhousekeep\r\n -m,  --migrate                   : Migrate the database from TXT to SQLITE3 and vice versa.\r\n -v,  --version                   : Show the cmbackup version.\r\n -h,  --help                      : Show this help\r\n\r\nFull Backup Options:\r\n\r\n -m,   --mail                     : Execute a backup of an account, but only the mailbox.\r\n -dl,  --distributionlist         : Execute a backup of a distributionlist instead of an account.\r\n -al,  --alias                    : Execute a backup of an alias instead of an account.\r\n -ldp, --ldap                     : Execute a backup of an account, but only the ldap entry.\r\n -sig, --signature                : Execute a backup of a signature.\r\n -d,   --domain                   : Execute a backup of only a set of domains, comma separated\r\n -a,   --account                  : Execute a backup of only a set of accounts, comma separated\r\n\r\nRestore Backup Options:\r\n\r\n -m,   --mail                     : Execute a restore of an account,  but only the mailbox.\r\n -dl,  --distributionlist         : Execute a restore of a distributionlist instead of an account.\r\n -al,  --alias                    : Execute a restore of an alias instead of an account.\r\n -ldp, --ldap                     : Execute a restore of an account, but only the ldap entry.\r\n -ro,  --restoreOnAccount         : Execute a restore of an account inside another account.\r\n -sig, --signature                : Execute a restore of a signature.\r\n -d,   --domain                   : Execute a backup of only a set of domains, comma separated\r\n -a,   --account                  : Execute a backup of only a set of accounts, comma separated<\/pre>\n<\/li>\n<\/ul>\n[\/vc_column_text][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"<p>[vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221; gradient_type=&#8221;default&#8221; shape_type=&#8221;&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221;&#8230;<\/p>\n","protected":false},"author":2,"featured_media":13066,"comment_status":"open","ping_status":"open","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[469],"tags":[],"class_list":{"0":"post-13000","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-linux"},"_links":{"self":[{"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/posts\/13000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/comments?post=13000"}],"version-history":[{"count":98,"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/posts\/13000\/revisions"}],"predecessor-version":[{"id":13356,"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/posts\/13000\/revisions\/13356"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/media\/13066"}],"wp:attachment":[{"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/media?parent=13000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/categories?post=13000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/myriad.ca\/index.php\/wp-json\/wp\/v2\/tags?post=13000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}