This document describes the procedure to set up CA sync between two Zentyal servers. We will use for this rsync being run in a cron job.
We will use root in the side that starts the connection (provided script will be run by cron) and ebox for the side that receives it. We could use any other user, but using user ebox avoid having to create extra unneeded configurations. For the sake of the example we’ll be referring to two servers here:

1. (Server A) The server on which the CA existed previously, and from which the files for the CA will be taken.
2. (Server B). The secondary server to which we want to export the CA which exists on Server A.

In order to better understand the procedure we must keep in mind that:
Zentyal CA files are stored on /var/lib/zentyal/CA
This folder has these permissions:

drwx r-x --x 9 ebox ebox

ebox user has as his home the folder /var/lib/zentyal/

• With this information, we’ll proceed to follow these steps:Check that rsync is installed in server B, and if not install it.

 sudo apt-get install rsync

• Check if root has a rsa key in server B. If it did not have, create if with ssh-keygen

 if [ ! -f /root/.ssh/id_rsa.pub ] ; then /usr/bin/ssh-keygen" ; else echo "Key Already exists" ; fi

• Create folder /var/lib/zentyal/.ssh/ and create file authorized_keys

sudo mkdir -p /var/lib/zentyal/.ssh/
sudo touch /var/lib/zentyal/.ssh/authorized_keys

• Chown both to ebox.ebox:

sudo chown -R ebox.ebox /var/lib/zentyal/.ssh/

• Copy the root public key to /var/lib/zentyal/.ssh/authorized_keys of server A. Given ebox user has no password you will have to do it by hand, as long as you won’t be able to do it with ssh-copy-id . Thus, open /root/.ssh/id_rsa.pub and paste its contents into /var/lib/zentyal/.ssh/authorized_keys of server A.

• Test that you can ssh without using password from root as ebox user:

sudo ssh ebox@SERVER-A-IP

• Now you can:

1. Limit connections from IP:

To do so edit in SERVER A /var/lib/zentyal/.ssh/authorized_keys, and add prior to the ssh-rsa this:

from="SERVER-B-IP" ssh-rsa dasghgdgh+RqUVx5wzgnaMxH2Km5KRx0Wzvsa5YvxjwERVVXs2mUEes5mDpoDMX9pUAwKqPCS5C
LyDwI+t0xNmVzPzeZjhypIfvBmgaG7pBNx7Zted7C+fha1X3SUmT4TguLzy7pfWbG7CKr2XkkFUYUOdUniYc99NsIxY1/51+/jjhfg
jhfg/Pr5jqH+jhfjfgj/jhfgjh+9kErROS1z root@hostname

2.  Ensuring that only rsync is used for this ssh connection:
To do so edit in SERVER A /var/lib/zentyal/.ssh/authorized_keys, and add prior to the ssh-rsa this:

command="/usr/share/bin/check_command.sh” ssh-rsa fdasghgdgh+RqUVx5wzgnaMxH2Km5KRx0Wzvsa5YvxjwERV
VXs2mUEes5mDpoDMX9pUAwKqPCS5CLyDwI+t0xNmVzPzeZjhypIfvBmgaG7pBNx7Zted7C+fha1X3SUmT4TguLzy7pfWbG7CKr
2XkkFUYUOdUniYc99NsIxY1/51+/jjhfgjhfg/Pr5jqH+jhfjfgj/jhfgjh+9kErROS1z root@hostname

Now, you must add the script it mentions this line (script taken from http://troy.jdmz.net/rsync/index.html)

#!/bin/sh

case "$SSH_ORIGINAL_COMMAND" in
*\&*)
echo "Rejected"
;;
*\(*)
echo "Rejected"
;;
*\{*)
echo "Rejected"
;;
*\;*)
echo "Rejected"
;;
*\<*)
echo "Rejected"
;;
*\`*)
echo "Rejected"
;;
*\|*)
echo "Rejected"
;;
rsync\ --server*)
$SSH_ORIGINAL_COMMAND
;;
*)
echo "Rejected"
;;
esac

If you use both, separate them with a “,”:

from="SERVER-B-IP",command="/usr/share/bin/check_command.sh” ssh-rsa fdasghgdgh+RqUVx5wzgnaMxH2Km5KRx0Wzvsa5Y
vxjwERVVXs2mUEes5mDpoDMX9pUAwKqPCS5CLyDwI+t0xNmVzPzeZjhypIfvBmgaG7pBNx7Zted7C+fha1X3SUmT4TguLzy7pfWbG7CKr2Xkk
FUYUOdUniYc99NsIxY1/51+/jjhfgjhfg/Pr5jqH+jhfjfgj/jhfgjh+9kErROS1z root@hostname

• Create the folder where you’re going to store the script that will do the sync and give it appropriate permissions:

mkdir /var/local/rsync-ca
chmod 754 /var/local/rsync-ca

• Create the script file and give it proper permissions:

 chmod 740 /var/local/sync-ca/rsync-ca

• Place the following content on the script (change variables as needed)

#!/bin/bash
RSYNC=/usr/bin/rsync
SSH=/usr/bin/ssh
KEY=/root/.ssh/id_rsa
RUSER=ebox
RHOST=SERVER-A-IP
RPATH=/var/lib/zentyal/CA
LPATH=/var/lib/zentyal/
$RSYNC -az -e "$SSH -i $KEY" $RUSER@$RHOST:$RPATH $LPATH

• Test the script and confirm that it works as expected

• Create the cron job for the script we have just created. For instance, to run this daily write under /etc/cron.d/rsync-ca :

 # /etc/cron.d/rsync-ca - Runs the script that syncs CA with SERVERA daily

SHELL=/bin/sh
PATH=/usr/bin:/bin

# Log data for report hourly
@daily root /var/local/rsync-ca/rsync-ca

It has been a long time since a new version of ANSTE was officially published, but this is also the biggest release so far. It’s not only a bugfixing release with minor improvements, this one has big changes. It’s not 1.0 yet, but we’re almost there

So, let’s summarize the main highlights:

• New anste-init command to easily create the skeleton of a new project
• Added python-anste wrapper for python-selenium
• Completed migration to YAML format, removed old XML support
• Allow to auto-download images from a server instead of creating them
• Use QCOW2 format instead of RAW for images
• Snapshots support via new anste-snapshot tool
• Tons of fixes and improvements

Full changelog is availabe at: https://github.com/Zentyal/anste/blob/master/ChangeLog

You have all the information about ANSTE at the brand new http://www.anste.org webpage, which features a fresh and renewed style, and also a demo screencast will be published coming very soon!

And by the way, if you are going to FOSDEM, don’t miss the ANSTE talk there!

Many people get confused when installed Zentyal about the differences between Zentyal Mail and Zentyal Groupware modules.

Zentyal provides mail functionality through Zentyal Mail module. It uses Postfix as the daemon to provide smtp functionality, and Dovecot as the daemon for POP3(s) and IMAP(s) functionalities. Where are mails stored? It stores mail files in /var/vmail/. You can enable which services (POP/IMAP) you want to have enabled in the Zentyal GUI:

Zentyal Groupware (zarafa)provides as well mail functionality. Zarafa will store mail on its database (Zarafa MySQL database when using Zentyal 3.0),and provides Webaccess as the interface for webmail. So What’s the difference with them?

• Zarafa provides you an address book with your LDAP users, so they don’t need to include their collegues by hand.
• Zarafa allows you to use (collaborative) calendar where you can write and share your day-by-day events.
• And the main one: Zarafa provides you with the possibility of allowing your users to use Exchange accounts for your domain (using the so-called Outlook Connectors) and to use their mobiles for Exchange accounts (using z-push).

So far so easy isn’t it? But many people get confused when configuring these. In order to clarify these, we’ll try to make clearer how Zarafa works, so configuration should be easier.
We’ll take for this a simple environment, with no Mailfilter module involved (as it will be transparent for this), and Zentyal Mail, Webmail, Zentyal Zarafa and Zentyal Webaccess (which is installed when installed zentyal-zarafa module)

For the first step, let’s take an environment with Zentyal Mail with POP3, Secure POP3, IMAP, and IMAPS configured and Zentyal Webmail modules. In this environment we have a single domain, say zentyal-domain.loc, and three users:

• john@zentyal-domain.loc
• doe@zentyal-domain.loc
• foo@zentyal-domain.loc

User john retrieves his mail through a Thunderbird/Outlook client with IMAP  and when he’s abroad, he checks it using it IMAPS on its mobile)

User doe retrieves his mail through POP3, and when he is abroad he checks it using IMAPS on its mobile)

User foo check his mail using webmail.

So, in this state-of-things any user can check his email using any method he might prefer (POP3, POP3S, IMAP, IMAPS or Webmail). But now we install the Zarafa module, and a new user bar@zentyal-domain.loc , and we define this user as a Zarafa user:

So, our user goes straight away to its Thunderbird mail client, and configures it but…gets nothing. We know that the should at least have received the welcome to the company email, so… what might have happened? He also checks webmail… and he finds the same result.

As we had told standard mail stores mail in /var/vmail while Zarafa does in MySQL. When a user is marked as non-Zarafa user its mail is sent to the filesystem, and if it is a Zarafa user mail is sent to MySQL. Now let us have a look to the first screenshot of this article. Yes, we still have enabled POP3, POP3S, IMAP and IMAPS. So meanwhile  we keep this configuration, no client can be used to check a zarafa account (unless using a Exchange account with an Outlook connector) as every method is still reserved for standard mail.  About the webmail, well you might have guessed, you user should point his browser to /webaccess (or /webapp, if webapp has been installed)  in order to check Zarafa mail, as Webmail module only checks standard mail.

So, in order for our user bar to be able to use Thunderbird, we have to disable in mail configuration some service. For our example we’ll leave the secure protocols for mail.

After saving changes, you’ll be able to enable the POP3 and IMAP gateways for Zarafa, and our user will be able to check Zarafa mail using these protocols. Don’t try enabling any gateway without disabling first on mail module config, as it will logically complain, as  the same port cannot be bind by two services:

Xavy Bahillo has just published a short article on configuration of Authentication and Shared Folders on Ubuntu using Zentyal as server.

He is showing a solution with SSSD and pam_mount.

http://www.jbahillo.com/remote-identification-and-storage

Zentyal server includes the most common network infrastructure services required by any type of organization. In fact, besides being used in small and medium enterprises, it is very popular in the education sector. Thanks to its ease of deployment and maintenance, many primary and secondary schools meet their network infrastructure needs using Zentyal server.

In this post we would like bring your attention to this Master Thesis project entitled ZentyES: Managing a secondary school network with Zentyal that will be useful for those system administrators and computer teachers looking for a complete network management solution for their education center. In this document you will find detailed information about how to deploy a Zentyal-based computer network in a secondary school and how to set it up quickly through Zentyal’s easy-to-use web interface.

The author of this project Guadalupe Bermejo has done a great job and we are proud to broadcast it on our channels. Her Master’s Thesis, written in Spanish, has been carried out within the Master in Free Software of Università Oberta de Catalunya. The project provides an analysis of requirements and alternatives, together with an implementation study with great attention to detail, extensive documentation and justification of decisions, all with an impressive level of professionalism.

The network architecture proposed in the project meets the current requirements of the center, but also takes into account the future needs. A thorough description of the implementation, with detailed screenshots and explanations have been included for the present and future system administrators to ease the understanding. Concretely, Bermejo proposes how to manage the local network infrastructure with DHCP and DNS services, to use the gateway for Internet access, and HTTP proxy for content filtering. [1]

If interested, you can learn about some other real use cases in schools where Zentyal-based solutions are used. For example, the use case of Studenterkursus High School in Aalborg, Denmark, that uses Zentyal as Office Server, Gateway and infrastructure manager. And the use case in the Department of Education of Aragon (Spain), that has deployed over 80 Zentyal servers in schools across the region.

During these years we have found out that many times it is the computer science teachers who actually take charge of maintaining their center’s network infrastructure and thanks to this, many learn about Zentyal. In case of vocation education centers, when teachers find out that Zentyal server includes most of the functionality they teach to their students, grouped in an all-in-one solution with an easy-to-use web interface, they often decide to include Zentyal studies in their training programs. And this is how Zentyal Academy, training program for official vocational education centers, was born! Read more about Zentyal Academy in this post about our participation in PUE’s Tech Learning Day and at Academy Program-page.

[1] Please note that the project is based on Zentyal 2.2, so if you plan to use it step by step to create your own Zentyal network, you might find out that there are some slight changes. But in essence it is very similar to Zentyal 3.0 so that it can perfectly serve as a basic guide.

Zentyal Team is proud to announce that a new Zentyal.org website is coming soon! This is something that we have had in our minds for quite some time already and now we are extremely glad to let you know that next Wednesday May 29 is the day when it will go live!

The main goals have been to improve the hierarchy and structure of the website in order to make it easier to access and share interesting information. We have also wanted to highlight the How-tos and tutorials made by Zentyal users so that all this great content will become more accessible for the whole community to enjoy it!

The site has been divided in four major blocks of content with the aim of making it much easier and quicker to find what you are looking for. Moreover some new pages have been included: Technical features of Zentyal server, external how-tos, information on training, visual resources and ideas on how you can contribute to the project.

Here you can see a detail of the four main sections on the homepage:

And here you have a detail on how the News section will look like:

A full list of technical features of Zentyal server will be available at one sight:

So, stay tuned! The new site will go live on May 29 and you can join the Zentyal Team to spread the word of the coolest website in the world !

It seemed that five songs could be good enough for a post, so here we go with another five different songs from the people at Zentyal HQ. Suspicions were right, we are actually persons, sometimes even humans, and we use to work listening to music at our headphones. Thus, I hope you could know us a little ‘byte’ more with these posts.

xX_SpOiLeR aLeRt_Xx (xD) It seems that in this song squad classics have arrived, but also some Spanish themes, so get your ears ready for these songs chosen by people at Zentyal HQ. If there would be a hidden camera over here, you will notice that headbanging duels is a local sport. Guess why? Let’s discover it!

AC/DC – Thunderstruck

Ironman movie is cool, but we all agree that it is because of those AC/DC moments. Anyway, Mateo’s choice should be on that place where only brilliant songs deserve to be at. Thunderstruck is one of those, simple but great. Let’s listen to it in this live performance.

Jorn – Blacksong

Melodic guitars and Jorn Lande’s voice; perfect ingredients for a terrific recipe. It was hard for Neru to choose just only one song for these posts, but after several changes this was the chosen one. What do you think? Check it out at Youtube.

Joaquín Sabina – Y sin embargo

Joaquín Sabina is one of the best sing-songwriter in Spain. Some of his songs are widely know over here, and this is one of those. It does not matter which kind of music do you like, everyone will know these lyrics. Let’s check out Exekias’ choice in Youtube (You can turn on English subtitles, highly recommended).

The White Stripes – Seven Nation Army

Talking about classics, here it comes a newer one. Everyone who listen to that first song notes would recognise it. Maybe not the title or the band, but sooner or later everyone has listen to it. Do not know the song? Listen to Bencer’s choice!

Tachenko – Escapatoria

To conclude with this second instalment a local band come up. Tachenko is an indie pop band from Zaragoza, but it is also sixstone’s choice. It is impossible not cheering up while listening to this song, check it out.

Hi all,

One of our main goals for Zentyal 3.2 is to revamp the look and feel of the Zentyal interface, we want to give it a new fresh touch of kindness but making it also a bit more aggressive. We’ve done some work already and you can have a sneak peek if you do the following on a root shell of your Zentyal machine:

apt-get update
apt-get install z32-theme-preview

In the improbable case you get tired of it and want to switch back to the classic theme, you can do it with just:

apt-get purge z32-theme-preview

And remember the Zentyal team don’t sleep, we just wait.

I am sure that I don’t need to drill you about the importance of backing up your system. Ideally the whole system is backed up, but this costs time and space.

However, as very convenient shortcut, there is an easy (and free) way of backing up the Zentyal server configuration. With this configuration backup you can quickly restore your Zentyal server to a production state. And it does not need to be the same box, you can also use the configuration backup to apply the configuration to a new server.

The configuration backup also includes all the user and group accounts so your users can continue logging in to the services they use.

There are several ways to make and restore the configuration backup. The more versatile is to use Zentyal Cloud Service that comes with the Free Account registration: this way the backup will reside in the cloud and you could apply it to any of your Zentyal boxes. You can get a free account here.

To access to this feature in the web interface, you must click in System -> Import/Export configuration. A console interface is also available through the programs ‘/usr/share/zentyal/make-backup’ and ‘/usr/share/zentyal/restore-backup’.

How this works?

To the curious among us, let me explain its internal workings. The backup is just an archive file in TAR format, that includes the files describing the configuration.

First, the backup process writes some files with metadata, like the current date or the packages installed in the system. Then it loops through the installed modules making each one to dump its configuration.

Remember that the configuration values we see reflected in the web interface are stored in a Redis backend. So each module must dump its Redis keys and value to a file. However the Redis keys are not sufficient for all modules. Remember that the users and its related data are stored in LDAP. In this case the users module does a dump of the full directory in LDIF format.

Likewise the samba module dumps its internal database and the modules which use OpenSSL certificates to store them in the backup archive.

When the backup is finished, it is stored in your local file system: you can download or restore it from the Zentyal web interface.

For restoring a backup the same process is run in reverse, picking each of the files and importing them to our Zentyal system.

Configuration backup and the Backup module

As you may known Zentyal also has a file backup module which allows you to set the files to be backed up, the destination of the backup and its frequency.

A configuration backup is added to the backup of the selected files to have better recovery odds.

Backup in the cloud

One problem remains in this configuration backup schema and it is to store it in a remote, always-accessible location. The location which meets these requirements is the Internet, now dubbed cloud.

Zentyal Remote offers this service. It checks daily your Zentyal configuration and the contents of the LDAP directory, if it finds any changes, it makes automatically a backup and sends it to the cloud.

The number of simultaneous held backups depends on the type of edition you have. A community edition with Free Account can store one configuration backup, a Small Bussiness or Enterprise edition can have up to seven configuration backups. Furthermore, the seven configuration backup-limit only applies to automatic backups, you can have as many manual backups as you like.

Once you have your backup in the cloud, you can restore it in any of your subscribed Zentyal servers using the web interface.

Post written by Javier Amor Garcia

Hello again my fellow Zentyal plumbers. This post is very related with the first one, this time covering Zarafa and related subsystems.

Zarafa is a groupware suite, including mail, calendars, contacts, task and notes which offers fully-fledged collaboration, sharing and access permission mechanisms. A remarkable feature of Zarafa is its integration with Microsoft clients and mobile synchronization protocols.

Let’s jump to the plumbing diagram already:

(click to enlarge image)

First of all, this diagram is a simplified and Zentyal-contextualized version of some parts of the Zarafa documentation: Zarafa Architecture, Zarafa Components. We encourage you to visit the official Zarafa documentation to continue learning about this platform.

Point by point:

A: Most of the mail subsystem components explained in the first post Plumbing part I are exactly the same for this version, so you still have Postfix as your MTA and the optional parts like Amavis security suite, Postgrey, Fetchmail and so on. Zarafa replaces the MDA, and adds the groupware services and gateways for several protocols and platforms.

B: The zarafa-dagent is the equivalent of a MDA (performing some of the roles of Dovecot for the former blogpost), it uses LMTP, a simplified and local-only version of the SMTP protocol to communicate with the MTA. Take into account that different MDA means different mailboxes for your users, if you migrate your virtual mail domain from Dovecot to Zarafa, the user mail addresses may remain the same, but they are accessing a different Inbox in different storage backend.

C: MySQL database, related to the last point. Zarafa stores mail and some mail metadata in a proper database, as opposed to the file-system based mail storage present in traditional mail systems.

D: The zarafa-spooler sends the mail waiting in the outgoing queue through the MTA.

E: Zarafa is tightly integrated with the Apache server in Zentyal, so the ‘Web Server’ module is required to offer all the web-based interfaces and protocols available to the users.

F: ‘Web access’ and ‘Web app’ are two web interfaces that offer the user a very convenient and fully featured way to access the mail and groupware services by just using their web browser. ‘Web access’ is oriented to look and feel like a microsoft outlook interface, while ‘Web app’ uses modern web protocols to improve the experience and can even integrate with chat and voice IP subsystems.

G: Z-push, an implementation of Microsoft’s ActiveSync protocol, available in all the major smartphone operative systems. Using this gateway you can synchronize all your mail, contacts and calendars information in your phone, bidirectionally, without installing additional apps and over the air.

H: Zarafa gateway for common mail services, IMAP4(S) and POP3(S), take into account that if your plan to offer a mail gateway, IMAPS for example, first you have to make sure that this port is disabled in Dovecot.

I: Microsoft Oulook offers MAPI, an interface to perform the synchronization against third party software. The Zarafa Windows Client needs to be installed in the Desktop OS. It bridges the Zarafa groupware protocols and Microsoft Outlook clients in transparent way for the users.

J: The MAPI commands are encoded in web-service SOAP and synchronized against Zarafa server.

Hope you have now a clearer vision of all the features and possibilities that Zarafa brings to the table. An important piece is missing in the diagram: how Zarafa server and Postfix connect to the LDAP to retrieve user auth and directory information. In the next post I intend to cover the Samba and Kerberos subsystems.

We have now updated our Pootle translation platform to a newer version, fixing some persistent problems with the string search functions. We are migrating the translations and accounts to the new system, so the users should not notice any major changes. Please, send us a notification if you detect any problem with your account or your translations.

The internationalization packages are updated from time to time, so you can get a new language-pack-zentyal- containing your language fixes eventually. If you don’t like waiting and want to try your translations right away, you can click on the ‘Translate’ tab inside your language section and then download the ‘zentyal.po’ file, using the ‘Download’ link.

You will need a local copy of the github Zentyal repository:

apt-get install git (if needed)
git clone git://github.com/Zentyal/zentyal.git

You will then, replace the ‘.po’ file in the repository. In my example I will overwrite zentyal/extra/language-packs/po/es.po. The file downloaded from pootle is named zentyal.po, so you will need to rename it.

Example:
mv ~/Downloads/zentyal.po ~/repos/zentyal/extra/language-packs/po/es.po

You will also need the package building tools:

apt-get install dpkg-dev

By default behavior is to build all the language packs, you probably don’t want this, so make a backup of the zentyal/extra/language-packs/debian/control file and then delete the unwanted packages.

Example for Spanish only:


Source: zentyal-language-packs
Section: web
Priority: optional
Maintainer: Zentyal Packaging Maintainers
Build-Depends: debhelper (>= 5.0.0), cdbs, po-debconf
Standards-Version: 3.8.2

Package: language-packs-zentyal-all
Architecture: all
Depends: language-pack-zentyal-es
Description: Zentyal translations for all supported languages
Zentyal is a Linux small business server that can act as
a Gateway, Unified Threat Manager, Office Server, Infrastructure
Manager, Unified Communications Server or a combination of them. One
single, easy-to-use platform to manage all your network services.
.
This metapackage includes the translations for all the languages.

Package: language-pack-zentyal-es
Architecture: all
Depends: zentyal-common (>= 3.0), ${misc:Depends}
Description: Zentyal translations for language Spanish
Zentyal is a Linux small business server that can act as
a Gateway, Unified Threat Manager, Office Server, Infrastructure
Manager, Unified Communications Server or a combination of them. One
single, easy-to-use platform to manage all your network services.
.
This package contains translations for the Spanish language.