Zimbra HA + Freenas Storage => Proxmox

Project : Zimbra HA + Freenas Storage + Proxmox 

Kali ini saya akan mencoba membuat project Zimbra HA menggunakan 1 storage.

Sebenarnya project ini akan direalisasikan ke Server Hardware.

Tapi untuk testing saya coba untuk install di Proxmox.

OK. Kita mulai.

PROXMOX 4.4

Terdapat 3 VM di proxmox yaitu

1. Host1.sample.net : Centos 7.3 192.168.100.1

2. Host2.sample.net : Centos 7.3 192.168.100.2

3. Freenas : Freenas 9.3 192.168.100.70

Sebagai tambahan untuk daftar IP yaitu Virtual IP mail.sample.net : 192.168.100.3

Disini saya tidak menjelaskan cara instalasi Centos dan Freenas.

FREENAS 9.3

Untuk Freenas saya coba pernah coba versi 10 tetapi tidak bisa share untuk ISCSInya mungkin karena banyak setingan yang belum saya tahu. Karena itu saya memutuskan versi 9.3.

ISCSI dibagi 2 :

1. ISCSI Target (Server Freenas)

2. ISCSI Initiator (Client Centos)

Setup ISCSI

- Masuk ke Menu Sharing - Block Iscsi

- Sub menu Target Global Configuration :

Base Name : iqn.2017-09.com.samplecorp.nas

- Sub menu Portals

Comment : iscsi network

Discovery Auth Methode : none (default)

Discovery Auth Group : none (default)

Portal IP

IP Address : 192.168.100.70

Port : 3260

- Sub menu Initiators

Initiators : iqn.1994-05.com.redhat:137939be31a (disesuaikan dgn host1 /etc/iscsi/initiatorname.iscsi)

iqn.1994-05.com.redhat:137939be31b (disesuaikan dgn host2 /etc/iscsi/initiatorname.iscsi)

Authorized network : ALL

- Sub menu Targets

Target Name : target-100gb

Target Alias : 100GB

ISCSI Group

Portal Group ID : 1 (iscsi network)

Initiators Group ID : 1

Auth Method : None

Authentication Group number : None

- Sub menu Extents

Extent Name : 100gb-extent

Exten Type : File

Serial: 10000003

Path to the extent : /mnt/vd1/ds1/100gb (data sheet yang sudah diseting sebelumnya)

Extent size : 100GB

Logical Block Size : 512

LUN RPM : 7200

- Sub menu Associated Targets

Target : target-100gb

LUN ID: Auto

Extent : 100gb-extent

HOST

Host1 dan host2 menggunakan Centos 7.3. Saya menggunakan versi 7 agar lebih update.

Seting Network di kedua host

1. Set BOOTPRO=none

[root@host1 ~]# vi /etc/sysconfig/network-scripts/ifcfg-eth0

2. Disable Network Manager

[root@host1 ~]# service NetworkManager stop

Redirecting to /bin/systemctl stop NetworkManager.service

[root@host1 ~]# systemctl disable NetworkManager

Removed symlink /etc/systemd/system/multi-user.target.wants/NetworkManager.service

Removed symlink /etc/systemd/system/dbus-org.freedesktop.NetworkManager.service

Removed symlink /etc/systemd/system/dbus-org.freedesktop.nm-dispatcher.service

3. Edit file

[root@host1 ~]# vi /etc/hosts

192.168.100.1 host1.sample.net host1

192.168.100.2 host2.sample.net host2

192.168.100.3 mail.sample.net mail

4. Install NTP

[root@host1 ~]# yum install ntp

[root@host1 ~]# service ntpd start

Redirecting to /bin/systemctl start ntpd.service

[root@host1 ~]# systemctl enable ntpd

Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service

5. Konfigurasi DNS

[root@host1 ~]# cat /etc/resolv.conf

# Generated by NetworkManager

search sample.net

nameserver 192.168.10.1

6. Install Bind (saya tidak menjelaskan disni)

- Open Firewall

[root@host1 ~]# firewall-cmd --permanent --add-port=53/tcp

[root@host1 ~]# firewall-cmd --permanent --add-port=53/udp

[root@host1 ~]# Firewall-cmd reload

7. Instalasi Iscsi initiator

[root@host1 ~]# yum install iscsi-initiator-utils -y

Cek file

[root@host1 ~]# cat /etc/iscsi/initiatorname.iscsi

InitiatorName=iqn.1994-05.com.redhat:137939be31a

Initiator Name ini diisikan di setingan Freenas di Sub menu Initiators

Cek iscsi

[root@host1 ~]# iscsiadm -m discovery -t sendtargets -p 192.168.100.70

192.168.100.70:3260,257 iqn.2017-11.net.sample.nas:target-100gb

Login iscsi

[root@host1 ~]# iscsiadm -m node -T iqn.2017-11.net.sample.nas:target-100gb --login

Cek disk, akan terdapat partisi baru. Buat partisi dan format disk.

Disni disk di /dev/sdb1 dengan format xfs

Buat direktori mount untuk zimbra

[root@host1 ~]# mkdir /data

CLUSTER

Untuk Cluster HA. Tahapannya.

1. Corosync

2. Pacemaker

3. Setup Cluster

4. Setup Resource

1. Instalasi Corosync

- Firewall

[root@host1 ~]# firewall-cmd --permanent --add-port=5404/udp

success

[root@host1 ~]# firewall-cmd --permanent --add-port=5405/udp

success

[root@host1 ~]# firewall-cmd --reload

success

[root@host1 ~]# yum install corosync -y

[root@host1 ~]# systemctl enable corosync

Created symlink from /etc/systemd/system/multi-user.target.wants/corosync.service to /usr/lib/systemd/system/corosync.service.

[root@host1 ~]# corosync-keygen

Corosync Cluster Engine Authentication key generator.

Gathering 1024 bits for key from /dev/random.

Press keys on your keyboard to generate entropy.

Press keys on your keyboard to generate entropy (bits = 920).

Press keys on your keyboard to generate entropy (bits = 1000).

Writing corosync key to /etc/corosync/authkey.

[root@host1 ~]# cp /etc/corosync/corosync.conf.example /etc/corosync/corosync.conf

Edit file corosync.conf

[root@host1 ~]# cat /etc/corosync/corosync.conf

totem {

version: 2

crypto_cipher: aes256

crypto_hash: sha256

interface {

bindnetaddr: 192.168.100.1

mcastaddr: 239.255.1.1

mcastport: 5405

ttl: 1

}

}

logging {

fileline: off

to_stderr: no

to_logfile: yes

logfile: /var/log/cluster/corosync.log

to_syslog: no

debug: off

timestamp: on

logger_subsys {

subsys: QUORUM

debug: off

}

}

quorum {

provider: corosync_votequorum

}

nodelist {

        node {

                ring0_addr: 192.168.100.1

                nodeid: 1

        }

        node {

                ring0_addr: 192.168.100.2

                nodeid: 2

        }

}

Copy file corosync.conf dan authkey

[root@host1 ~]# scp /etc/corosync/corosync.conf host2:/etc/corosync/corosync.conf

[root@host1 ~]# scp /etc/corosync/authkey host2:/etc/corosync/authkey

Karena kita hanya menggunakan 2 node maka edit file di corosync.conf

Cek corosync

[root@host1 ~]# corosync-quorumtool

Quorum information

------------------

Date:             Fri Nov  3 15:54:46 2017

Quorum provider:  corosync_votequorum

Nodes:            2

Node ID:          2

Ring ID:          1/760

Quorate:          Yes

Votequorum information

----------------------

Expected votes:   2

Highest expected: 2

Total votes:      2

Quorum:           1  

Flags:            2 Node Quorate WaitForAll

Membership information

----------------------

    Nodeid      Votes Name

         1          1 192.168.100.1

         2          1 192.168.100.2 (local)

Backup file corosync

[root@host1 ~]# cp /etc/corosync/corosync.conf /etc/corosync/corosync.WORKING

2. Instalasi Pacemaker

[root@host1 ~]# firewall-cmd --add-port=2224/tcp --permanent

success

[root@host1 ~]# firewall-cmd --reload

success

[root@host1 ~]# yum install pacemaker -y

[root@host1 ~]# systemctl enable pacemaker

Created symlink from /etc/systemd/system/multi-user.target.wants/pacemaker.service to /usr/lib/systemd/system/pacemaker.service.

[root@host1 ~]# yum install pcs

[root@host1 ~]# service pcsd start

[root@host1 ~]# systemctl enable start

3. Setup Cluster

[root@host1 ~]# passwd hacluster

Changing password for user hacluster.

New password:

BAD PASSWORD: The password fails the dictionary check - it is based on a dictionary word

Retype new password:

passwd: all authentication tokens updated successfully.

[root@host1 ~]# pcs cluster auth 192.168.100.1 192.168.100.2

Username: hacluster

Password:

192.168.100.2: Authorized

192.168.100.1: Authorized

[root@host1 ~]# pcs cluster setup --name hacluster 192.168.100.1 192.168.100.2 --force

Destroying cluster on nodes: 192.168.100.1, 192.168.100.2...

192.168.100.1: Stopping Cluster (pacemaker)...

192.168.100.2: Stopping Cluster (pacemaker)...

192.168.100.1: Successfully destroyed cluster

192.168.100.2: Successfully destroyed cluster

Sending 'pacemaker_remote authkey' to '192.168.100.1', '192.168.100.2'

192.168.100.1: successful distribution of the file 'pacemaker_remote authkey'

192.168.100.2: successful distribution of the file 'pacemaker_remote authkey'

Sending cluster config files to the nodes...

192.168.100.1: Succeeded

192.168.100.2: Succeeded

Synchronizing pcsd certificates on nodes 192.168.100.1, 192.168.100.2...

192.168.100.2: Success

192.168.100.1: Success

Restarting pcsd on the nodes in order to reload the certificates...

192.168.100.2: Success

192.168.100.1: Success

--force harus digunakan karena sudah  ada file sebelumnya

[root@host1 ~]# pcs cluster start --all

192.168.100.2: Starting Cluster...

192.168.100.1: Starting Cluster...

[root@host1 ~]# pcs cluster status

Cluster Status:

 Stack: corosync

 Current DC: host2.sample.net (version 1.1.16-12.el7_4.4-94ff4df) - partition with quorum

 Last updated: Mon Oct 30 04:35:48 2017

 Last change: Mon Oct 30 04:34:49 2017 by hacluster via crmd on host2.sample.net

 2 nodes configured

 0 resources configured

PCSD Status:

  host2.sample.net (192.168.100.2): Online

  host1.sample.net (192.168.100.1): Online

Validasi cluster

[root@host1 ~]# crm_verify -L -V

   error: unpack_resources: Resource start-up disabled since no STONITH resources have been defined

   error: unpack_resources: Either configure some or disable STONITH with the stonith-enabled option

   error: unpack_resources: NOTE: Clusters with shared data need STONITH to ensure data integrity

Errors found during check: config not valid

Terdapat error, maka disable stonith

[root@host1 ~]# pcs property set stonith-enabled=false

[root@host1 ~]# crm_verify -L -V

[root@host1 ~]#

Jalankan cluster startup

[root@host1 ~]# systemctl enable pcsd

4. Setup Resource Cluster

- IP Resource

[root@host1 ~]# pcs resource create ClusterIP ocf:heartbeat:IPaddr2 ip=192.168.100.4 cidr_netmask=24 nic=eth0:0 op monitor interval=30s

Sampai sini coba untuk test HA.

Matikan host1. Seharusnya ClusterIP akan berjalan di host2.sample.net.

Lanjutkan..

- Filesystem Resource

[root@host1 ~]# pcs resource create Filesystem Filesystem device="/dev/sdb1" directory="/data" fstype="xfs"

[root@host1 ~]# pcs resource show

 ClusterIP (ocf::heartbeat:IPaddr2)  : Started host1.sample.net

 Filesystem (ocf::heartbeat:Filesystem): Started host1.sample.net

Membuat Resource menjadi 1 location

[root@host1 ~]# pcs constraint colocation add ClusterIP Filesystem

[root@host1 ~]# pcs constraint show

Location Constraints:

  Resource: Zimbrasvc

    Enabled on: host1 (score:INFINITY)

    Enabled on: host1.sample.net (score:INFINITY)

Ordering Constraints:

Colocation Constraints:

  ClusterIP with Filesystem (score:INFINITY)

Tips Menghapus node di cluster

Contoh : sebelumnya saya membuat host3

Jalankan di seluruh cluster

1. Hapus node di nodelist corosync.conf

2. Stop Cluster

3. Check cluster

[root@host1 ~]# pcs  status

Cluster name: hacluster

WARNING: corosync and pacemaker node names do not match (IPs used in setup?)

Stack: corosync

Current DC: host1.sample.net (version 1.1.16-12.el7_4.4-94ff4df) - partition with quorum

Last updated: Tue Oct 31 00:23:02 2017

Last change: Tue Oct 31 00:06:25 2017 by root via cibadmin on host1.sample.net

3 nodes configured

2 resources configured

Online: [ host1.sample.net host2.sample.net ]

OFFLINE: [ host3.sample.net ]

Full list of resources:

 Resource Group: Website

     ClusterIP (ocf::heartbeat:IPaddr2): Started host1.sample.net

     Webserver (ocf::heartbeat:apache): Started host1.sample.net

Daemon Status:

  corosync: active/enabled

  pacemaker: active/enabled

  pcsd: active/enabled

Terlihatnode host3.sample.net OFFLINE

4. Hapus offline cluster jalankan di cluster host1 dan host2

[root@host1 ~]# cibadmin --delete --xml-text ''

[root@host1 ~]# cibadmin --delete --xml-text ''

Tips Membuat Group Cluster

[root@host1 ~]# pcs resource group add Zimbra ClusterIP Filesystem

[root@host1 opt]# pcs status

Cluster name: hacluster

WARNING: corosync and pacemaker node names do not match (IPs used in setup?)

Stack: corosync

Current DC: host1.sample.net (version 1.1.16-12.el7_4.4-94ff4df) - partition with quorum

Last updated: Fri Nov  3 17:54:28 2017

Last change: Fri Nov  3 17:54:27 2017 by root via cibadmin on host1.sample.net

2 nodes configured

3 resources configured

Online: [ host1.sample.net host2.sample.net ]

Full list of resources:

 Resource Group: Zimbra

     ClusterIP (ocf::heartbeat:IPaddr2): Started host1.sample.net

     Filesystem (ocf::heartbeat:Filesystem): Started host1.sample.net

Daemon Status:

  corosync: active/enabled

  pacemaker: active/enabled

  pcsd: active/enabled

Tips Menghapus Resource

[root@host1 ~]# pcs resource deleteClusterIP

ZIMBRA

Zimbra yang kita gunakan versi zcs-8.8.3_GA_1872.RHEL7_64

Install Zimbra di Host 1

Beberapa hal yang perlu dipastikan yaitu :

- DNS harus aktif

- Cluster berjalan di host1.sample.net

- Ping mail.sample.net harus aktif dan berjalan di Virtual IP host1

- dig mx sample.net harus mengacu ke mail.sample.net

- nslookup mail.sample.net mengacu ke 192.168.100.3

- Di host1 open firewall, masukkan perintah di bawah :

firewall-cmd --permanent --add-service=https

firewall-cmd --permanent --add-service=http

firewall-cmd --permanent --add-service=ldap

firewall-cmd --permanent --add-port=22/tcp

firewall-cmd --permanent --add-port=25/tcp

firewall-cmd --permanent --add-port=110/tcp

firewall-cmd --permanent --add-port=143/tcp

firewall-cmd --permanent --add-port=993/tcp

firewall-cmd --permanent --add-port=995/tcp

firewall-cmd --permanent --add-port=7025/tcp

firewall-cmd --permanent --add-port=7071/tcp

firewall-cmd --permanent --add-port=587/tcp

firewall-cmd --permanent --add-port=465/tcp

Download Zimbra Open Source Edition di situs Zimbra untuk Centos 7.

Misal file di simpan di /root.

Extrak file tarball

[root@host1 ~]# tar -xzvf zcs-8.8.3_GA_1872.RHEL7_64.20170905143325.tgz

[root@host1 ~]# cd zcs-8.8.3_GA_1872.RHEL7_64.20170905143325

[root@host1 zcs-8.8.3_GA_1872.RHEL7_64.20170905143325]#./install.sh

Zimbra Instalation Package

Zimbra-ldap

Zimbra-logger

Zimbra-mta

Zimbra-snmp

Zimbra-store

Zimbra-apache

Zimbra-spell

Zimbra-memcached

Zimbra-proxy

DNS hostname = mail.sample.net

Domain name = sample.net

- Test Zimbra

- Matikan service Zimbra

[root@host1 ~]# su zimbra

[zimbra@host1 root]$ zmcontrol stop

Lanjutkan instalasi zimbra di host2 seperti cara diatas dan matikan service zimbra

Kembali ke host1 (hanya di salah satu host)

- Setelah instalasi selesai, copy file zimbra /opt/zimbra ke Disk Storage /data.

- Pastikan folder /data sudah mengacu ke disk /dev/sdb1

- Copy file zimbra kecuali data.mdb menggunakan rsync

[root@host1 ~]#  rsync -avP --exclude=data.mdb /opt/zimbr  /data/

File data.mdb ukuran file adalah 80GB, dan realnya hanya 1 MB (zimbra fresh).

Jika menggunakan perintah rsync maka bisa menghasilkan space 80GB pula.

- Copy file data.mdb menggunakan cp

[root@host1 ~]#  cp -ap /opt/zimbra/data/ldap/mdb/db/data.mdb /data/zimbra.old/data/ldap/mdb/db/

- Rename folde /opt/zimbra

[root@host1 ~]#  mv /opt/zimbra  /opt/zimbra.old

- Buat Link zimbra folder dari folder /data/zimbra ke /opt/zimbra

[root@host1 ~]#  ln -s /data/zimbra  /opt/zimbra

- Coba test jalankan Zimbra kembali

Resource Zimbra

- Stop service Zimbra kembali. Dan buat file untuk resource cluster service Zimbra

- Buat script zimbractl

[root@host1 ~]# vi /usr/lib/ocf/resource.d/heartbeat/zimbractl

#!/bin/sh

#

# Resource script for Zimbra

#

# Description:  Manages Zimbra as an OCF resource in

#               an high-availability setup.

#

# Author:       RRMP

# License:      GNU General Public License (GPL)

#

#

#       usage: $0 {start|stop|reload|monitor|validate-all|meta-data}

#

#       The "start" arg starts a Zimbra instance

#

#       The "stop" arg stops it.

#

# OCF parameters:

#  OCF_RESKEY_binary

#  OCF_RESKEY_config_dir

#  OCF_RESKEY_parameters

#

##########################################################################

# Initialization:

: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}

. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs

: ${OCF_RESKEY_binary="zmcontrol"}

: ${OCF_RESKEY_zimbra_dir="/opt/zimbra"}

: ${OCF_RESKEY_zimbra_user="zimbra"}

: ${OCF_RESKEY_zimbra_group="zimbra"}

USAGE="Usage: $0 {start|stop|reload|status|monitor|validate-all|meta-data}";

##########################################################################

usage() {

echo $USAGE >&2

}

meta_data() {

cat <

0.1

This script manages Zimbra as an OCF resource in a high-availability setup.

Manages a highly available Zimbra mail server instance

Short name to the Zimbra control script.

For example, "zmcontrol" of "/etc/init.d/zimbra".

Short name to the Zimbra control script

Full path to Zimbra directory.

For example, "/opt/zimbra".

Full path to Zimbra directory

Zimbra username.

For example, "zimbra".

Zimbra username

 unique="1" required="0">

Zimbra group.

For example, "zimbra".

Zimbra group

 interval="60s" />

END

}

case $1 in

meta-data)

meta_data

exit $OCF_SUCCESS

;;

usage|help)

usage

exit $OCF_SUCCESS

;;

start)

echo "Starting Zimbra Services"

echo "0" > /var/log/db-svc-started.log

rm -f /var/log/zimbra-svc-stopped.log

if [ -f /etc/init.d/zimbra ]

then

/etc/init.d/zimbra start

fi

ocf_log info "Zimbra started."

exit $OCF_SUCCESS

;;

stop)

echo "Stopping Zimbra Services"

rm -f /var/log/db-svc-started.log

echo "0" > /var/log/zimbra-svc-stopped.log

if [ -f /etc/init.d/zimbra ]

then

/etc/init.d/zimbra stop

/bin/killall -9 -u zimbra

fi

ocf_log info "Zimbra stopped."

exit $OCF_SUCCESS

;;

status|monitor)

echo "Zimbra Services Status"

if [ -f /var/log/zimbra-svc-started.log ]

then

exit $OCF_SUCCESS

else

exit $OCF_NOT_RUNNING

fi

;;

restart|reload)

echo "Zimbra Services Restart"

ocf_log info "Reloading Zimbra."

if [ -f /etc/init.d/zimbra ]

then

/etc/init.d/zimbra stop

/bin/killall -9 -u zimbra

/etc/init.d/zimbra start

fi

exit $OCF_SUCCESS

;;

validate-all)

echo "Validating Zimbra"

exit $OCF_SUCCESS

;;

*)

usage

exit $OCF_ERR_UNIMPLEMENTED

;;

esac

Buat Resource dengan nama Zimbrasvc

[root@host1 ~]# pcs resource create Zimbrasvc ocf:heartbeat:zimbractl

[root@host1 ~]# pcs resource show

 Resource Group: Zimbra

     ClusterIP (ocf::heartbeat:IPaddr2): Started host1.sample.net

     Filesystem (ocf::heartbeat:Filesystem): Started host1.sample.net

     Zimbrasvc (ocf::heartbeat:zimbractl): Started host1.sample.net

Test kembali apakah zimbra berjalan lancar

Jika terdapat error pastikan :

1. Mapping drive /data sudah ke /dev/sdb1 (storage iscsi di freenas)

2. Virtual IP sudah terkoneksi

3. Cluster service berjalan di kedua host

Tips PENTING setelah ZImbra aktif

1. Sebelum mengcopy file /opt/zimbra ke folder lain (/zimbra) pastikan zimbra sudah off

2. Service Zimbra dimatikan di startup, karena service akan dilayani oleh pcs

Catatan : Resource Cluster yang berkaitan dengan service dinonaktifkan untuk otomatis startup di OS nya.

Jadi service akan dikelola/dijalankan oleh pacemaker.

Cek Cluster status

[root@host1 ~]# pcs status

Cluster name: hacluster

WARNING: corosync and pacemaker node names do not match (IPs used in setup?)

Stack: corosync

Current DC: host2.sample.net (version 1.1.16-12.el7_4.4-94ff4df) - partition with quorum

Last updated: Tue Nov  7 12:27:24 2017

Last change: Mon Nov  6 21:08:47 2017 by root via cibadmin on host1.sample.net

2 nodes configured

3 resources configured

Online: [ host1.sample.net host2.sample.net ]

Full list of resources:

 Resource Group: Zimbra

     ClusterIP (ocf::heartbeat:IPaddr2): Started host1.sample.net

     Filesystem (ocf::heartbeat:Filesystem): Started host1.sample.net

     Zimbrasvc (ocf::heartbeat:zimbractl): Started host1.sample.net

Daemon Status:

  corosync: active/enabled

  pacemaker: active/enabled

  pcsd: inactive/enabled

[root@host1 ~]#

Test matikan pcs di host1, seharusnya akan berpindah ke host2

[root@host1 ~]# pcs cluster stop

Stopping Cluster (pacemaker)...

Stopping Cluster (corosync)...

Pindah ke host2

[root@host2 ~]# pcs status

Cluster name: hacluster

WARNING: corosync and pacemaker node names do not match (IPs used in setup?)

Stack: corosync

Current DC: host2.sample.net (version 1.1.16-12.el7_4.4-94ff4df) - partition with quorum

Last updated: Tue Nov  7 12:30:31 2017

Last change: Mon Nov  6 21:08:47 2017 by root via cibadmin on host1.sample.net

2 nodes configured

3 resources configured

Online: [ host2.sample.net ]

OFFLINE: [ host1.sample.net ]

Full list of resources:

 Resource Group: Zimbra

     ClusterIP (ocf::heartbeat:IPaddr2): Started host2.sample.net

     Filesystem (ocf::heartbeat:Filesystem): Started host2.sample.net

     Zimbrasvc (ocf::heartbeat:zimbractl): Stopped

Daemon Status:

  corosync: active/enabled

  pacemaker: active/enabled

  pcsd: active/enabled

[root@host2 ~]#

Jika dilihat zimbrasvc masih stop statusnya, jangan khawatir service zimbra lumayan memakan waktu agar service running semua.

Bisa dicek di

[root@host2 ~]# su zimbra

[zimbra@host2 root]$ zmcontrol status

 Cek juga di log apakah ada yang failed

[root@host2 ~]# tail -f /var/log/zimbra.log

Cek kembali cluster status

[root@host2 ~]# pcs status

Cluster name: hacluster

WARNING: corosync and pacemaker node names do not match (IPs used in setup?)

Stack: corosync

Current DC: host2.sample.net (version 1.1.16-12.el7_4.4-94ff4df) - partition with quorum

Last updated: Tue Nov  7 12:35:12 2017

Last change: Mon Nov  6 21:08:47 2017 by root via cibadmin on host1.sample.net

2 nodes configured

3 resources configured

Online: [ host2.sample.net ]

OFFLINE: [ host1.sample.net ]

Full list of resources:

 Resource Group: Zimbra

     ClusterIP (ocf::heartbeat:IPaddr2): Started host2.sample.net

     Filesystem (ocf::heartbeat:Filesystem): Started host2.sample.net

     Zimbrasvc (ocf::heartbeat:zimbractl): Started host2.sample.net

Daemon Status:

  corosync: active/enabled

  pacemaker: active/enabled

  pcsd: active/enabled

Jalankan kembali seluruh cluster

[root@host1 ~]# pcs cluster start

Starting Cluster...

Biasanya host2 akan tetap aktif Started host2.sample.net

Untuk kelanjutannya bisa simak dibawah.

Finally Resource PCS

1. Membuat resource menjadi 1 lokasi (colocation)

[root@host1 ~]# pcs constraint colocation add ClusterIP Filesystem Zimbrasvc

Sebelum disetting colocation, biasanya antar Resource berbeda running di host yang ada. Misal Cluster IP di host1, sedangkan Filesystem di host2

2. Membuat resource menjadi 1 group dengan nama group Zimbra

[root@host1 ~]# pcs resource group add Zimbra ClusterIP Filesystem Zimbrasvc

3. Membuat default resource berjalan di host1 (location)

[root@host1 ~]# pcs constraint location Zimbra host1.sample.net=50

Secara default service akan berjalan di host1. Jika host1 down, maka host2 aktif. Dan bilamana host1 aktif kembali, maka cluster aktif akan pindah kembali ke host1. Angka 50 merupakan angka bebas

Coba test kembali stop cluster di host1. Seharusnya cluster aktif pindah ke host2.

SELESAI

Konfigurasi DNS Public Master dan Slave

Berikut catatan saya mengenai DNS yang mengunakan IP Public.
Awalnya kita tidak memiliki DNS yang terhubung ke Public. DNS Public hanya ada di ISP dengan menggunakan control Panel.
Untuk memudahkan pengelolaan kita akan membuat DNS yang terhubung ke IP Public. Dan pengelolaan Domain tidak lagi di Control Panel ISP atau Situs Penjual Domain.

Sebelum merubah domain corporate, saya coba membeli domain baru contoh example.xyz Kebetulan domain tersebut tersebut lumayan murah hanya Rp. 16.000/tahun. Yah untuk coba2 dan testing.


Berikut gambarannya (bukan sebenarnya):

NS Godady : ns1.godaddy.com dan ns2.godaddy.com


Lokasi A (Master)
IP Public Mikrotik : 103.4.x.x
Server DNS :192.168.100.3

Lokasi B (Slave)
IP Public Mikrotik 117.102.x.x dan 112.78.x,x
Server DNS : 192,168.200.3



Domain yang saya beli di godaddy.com lantas saya coba rubah untuk NS (Name Server).

Di halaman godaddy sudah ada 2 alamat NS default. Anehnya NS tersebut tidak dapat diedit diganti dengan IP Public A. Jadi ketika kita menambahkan NS, maka NS yang kita buat akan hilang dan masih menggunakan NS default. Dan mungkin ada kesalahan dari saya perihal konfigurasinya.
Berikut konfigurasi setelah beberapa kali Trial Error.

Tahapan :
Lokasi A (Master) Centos 6.5
1. Setting di /etc/named.conf

options {
//      listen-on port 53 { 127.0.0.1; };
        listen-on port 53 { 192.168.100.3; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
//      allow-query     { localhost; };
        allow-query     { any; };
//      allow-recursion { 127.0.0.1; };
        allow-transfer  { 127.0.0.1; 117.102.x.x; };
        recursion no;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";
        forwarders {180.131.144.144; 8.8.4.4; };
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "ithighpro.xyz" in {
        type master;
        file "example.xyz.zone";
        allow-update { none; };
};

zone "100.168.192.in-addr.arpa" in {
        type master;
        file "100.168.192.in-addr.arpa.zone";
        allow-update { none; };
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";


!!! Recursion disetting no untuk menghindari Ddos attack

2. Setting file zona /var/named/example.xyz.zone

$TTL 1d

@       600     IN      SOA     ns1.example.xyz. root.ithighpro.xyz. (
                                201611xx
                                28800
                                7200
                                604800
                                600
                                )

;Name server's
@       IN      NS      ns1.ithighpro.xyz.
@       IN      NS      ns2.ithighpro.xyz.

;Name server hostname to IP resolve
@       IN      A       103.4.x.x
@       IN      A       117.102.x.x

;MX Records
@       IN      MX      10      mail.example.xyz.
@       IN      MX      20      mail2.example.xyz.

;Hosts in this Domain

ns1             IN      A       103.4.x.x
ns2             IN      A       117.102.x.x

mail            IN      A       103.4.x.x
mail2           IN      A       117.102.x.x

www             IN      A       117.102.x.x
owncloud        IN      A       112.78.x.x

Untuk mengecek konfigurasi yang sudah pernah kita buat bisa menjalan perintah :

[root@mail named]#named-checkconf /etc/named.conf
[root@mail named]#named-checkzone example.xyz /var/named/example.xyz.zone
zone example.xyz/IN: loaded serial 201611xx
OK

Jika hasilnya sudah seperti diatas berarti konfigurasi sudah dianggap benar.


Lokasi B (Slave) Centos 7.2
1. Edit File /etc.named.conf
options {
        listen-on port 53 { 127.0.0.1; 192.168.200.3; };
#       listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        allow-transfer  { 127.0.0.1; 103.4.x.x; };

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recurs                                                                                        ion.
         - If you are building a RECURSIVE (caching) DNS server, you need to ena                                                                                        ble
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable                                                                                         access
           control to limit queries to your legitimate users. Failing to do so w                                                                                        ill
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion no;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};


zone "example.xyz" IN {
        type slave;
        file "slaves/example.xyz.zone";
        masters { 103.4.x.x; };
};


2. Edit File Zona /var/named/slaves/example.xyz.zone

$TTL 86400
@   IN  SOA     ns1.example.xyz. root.example.xyz. (
        201611xxx  ;Serial
        3600        ;Refresh
        1800        ;Retry
        604800      ;Expire
        86400       ;Minimum TTL
)
         NS             ns1.example.xyz.
         NS             ns2.example.xyz.

         A              103.4.x.x
;        A              192.168.200.3
         MX 10          mail.example.xyz.
         MX 20          mail2.example.xyz.


ns1      A              103.4.x.x
ns2      A              192.168.200.3

mail     A              103.4.x.x
mail2    A              117.102.x.x
www      A              117.102.x.x


Tools untuk membantu pengecekan konfigurasi :
- https://intodns.com/example.xyz

Di tools ini kita bisa melihat konfigurasi yang kurang tepat.



Beberapa hal penting :
1. Untuk serial di zona file harus disamakan antara master dan slaves
2. Pengeditan/penambahan NS di Godaddy disebabkan NS yang kita buat belum terbentuk. Dan minimal NS haru ada 2. Jika hanya 1 maka NS masih menggunakan Godaddy
3. Setelah DNS di 2 lokasi terbentuk maka secara otomatis pengelolaan domain ada di Lokasi kita bukan di Godaddy.

Zimbra Error Subject : ***UNCHECKED***

Beberapa hari yang lalu Subject email Zimbra selalu di tambahkan tulisan ***UNCHECKED***.
Padahal tidak ada perubahan konfigurasi mail server sebelumnya. Cari di google ada beberapa referensi yaitu merubah file /opt/zimbra/.

Tahapan :
#su root
#cd /opt/zimbra/amavisd/bin
#cp -pa amavisd amavid.org
#vi amavisd

Rubah isi file di baris :
#su zimbra
$undecipherable_subject_tag = '***UNCHECKED*** ';
menjadi
$undecipherable_subject_tag = '';  
$zmamavisdctl restart

Di hari berikutnya saya coba cek kembali utilisasi mail dengan 'top'. Terilhat penggunaan clamd sebesar 100%.

Coba dicek di log /var/log/zimbra.log |grep clamd hasilnya

mail amavis[26778]: (26778-07) ClamAV-clamd: All attempts (1) failed connecting to /opt/zimbra/data/clamav/clamav.sock, retrying (1)
Oct 24 10:10:43 mail amavis[26778]: (26778-07) (!)connect to /opt/zimbra/data/clamav/clamav.sock failed, attempt #1: Can't connect to UNIX socket /opt/zimbra/data/clamav/clamav.sock: Connection refused

Clamd running tetapi tidak dapat terkoneksi ke socketnya.
Saya coba restart $zmclamdctl restart
hasilnya clamav tidak bisa distop, akhirnya di kill manual.

Tahapan :
$ps -afx |grep clam
 2812 ?        Ssl    0:20 /opt/zimbra/clamav/sbin/clamd --config-file=/opt/zimbra/conf/clamd.conf

$kill -9 2812
$zmclamdctl restart

Setelah dicek kembali di 'top' normal. Dan di log juga tidak error clamav.sock.

Zimbra Tips : Copy account zimbra lama ke user zimbra baru

1. Menggunakan console di server

su – zimbra

zmmailbox -z -m userlama@domain.com getRestURL “//?fmt=tgz” > /tmp/v.tar.gz

zmmailbox -z -m userbaru@domain.com postRestURL “//?fmt=tgz&resolve=reset” /tmp/v.tar.gz

2. Menggunakan Browser

Source Account:

In Zimbra Webmail:

• click on the Preferences Tab, and select Import/Export in the left menu to open the Import/Export page.
• Under Export, leave "Account" selected to export mail messages, then either leave "All Folders" selected or click there and and select the folder you'd like to export.
• Click on Export. You will be prompted by your computer Archive software to either open the resulting file or save it to your computer. Select Save and select a location to save it on your computer.

Destination Account:

In Zimbra Webmail:

• click on the Preferences Tab, and select Import/Export in the left menu to open the Import/Export page.
• Under Import, select the file to import from your computer.
• Select the destination folder.
• Click on Import.

Moment

Postfix Roundcube to Zimbra

ADMINISTRATOR

Mekanisme Migrasi Email

1. Melakukan reset password kesemua email di Mail Server lama

2. Melakukan sinkronisasi email, dari mail server lama ke mail server baru. Dimana tools yang digunakan memerlukan password email lama dan password email yang baru

TAHAPAN MIGRASI

A. Instalasi Server Baru

1. Install Centos 6.4 64bit

2. Install Zimbra 8.0

3. Konfigurasi Zimbra dengan domain testdomain.com

4. Masukkan domain lain yaitu plastikinject.com dan rovega,net

B. Restore Nama Account Server Lama ke Server Baru

1. Copy file /etc/passwd dan /etc/shadow server lama ke server baru dan ke PC Desktop Administrator

2. Pengambilan data account email lama dari file /etc/passwd

- Buka file /etc/passwd di excel.

- Pisahkan domain testdomain dengan domain lain dengan cara menghapus tulisan testdomain

- Simpan file passwd.testdomain

- Kirim file tersebut ke server baru.

3. Jalankan script passwd2zmprov. Script ini akan mengambil data dari file passwd.testdomain dan mengisikannya dengan attribut lain agar bisa dimasukkan ke account zimbra yang baru

[root@mail script]# perl passwd2zmprov -domain testdomain.com passwd.testdomain > testdomain.zmp

Contoh file /etc/passwd

anton.prasetyo.testdomain:x:2165:1002:Anton Prasetyo:/home/testdomain/homes/anton.prasetyo:/dev/null

ryansetiawan.swhmedan.testdomain:x:2167:1002:Ryan Agus Setiawan:/home/testdomain/homes/ryansetiawan.swhmedan:/dev/null

Contoh file passwd.testdomain :

anton.prasetyo:x:2165:1002:Anton Prasetyo:/home/testdomain/homes/anton.prasetyo:/dev/null

ryansetiawan.swhmedan:x:2167:1002:Ryan Agus Setiawan:/home/testdomain/homes/ryansetiawan.swhmedan:/dev/null

Contoh file testdomain.zmp

ca "anton.prasetyo@testdomain.com" "" givenName "Anton" sn "Prasetyo" cn "anton.prasetyo" displayName "Anton Prasetyo" zimbraNotes "Migrated Wed Oct 23 11:25:55 2013" zimbraPasswordMustChange FALSE

ca "ryansetiawan.swhmedan@testdomain.com" "" givenName "Ryan" sn "Setiawan" cn "ryansetiawan.swhmedan" displayName "Ryan Agus Setiawan" zimbraNotes "Migrated Wed Oct 23 11:25:55 2013" zimbraPasswordMustChange FALSE

4. Buat account baru di server baru menggunakan file testdomain.zmp. Penggunaan command zmprov harus menggunakan user zimbra

[zimbra@mail script]$ zmprov -f testdomain.com

Account akan langsung otomatis terbuat dengan domain testdomain.com

5. Merestore password lama ke server zimbra yang baru.

- Edit file /etc/shadow. Pisahkan

- Jalankan script

[root@mail script]# ./shadow2zm.pl /etc/shadow > passwd.zm atau

[root@mail script]# ./shadow2zm.pl shadow.testdomain > shadow.testdomain.zm

[root@mail script]# chmod 755 passwd.zm atau

[root@mail script]# chmod 755 passwd.shadow.testdomain.zm

[root@mail script]# su zimbra

[zimbra@mail script]$ ./passwd.zm atau

[zimbra@mail script]$ ./passwd.shadow.testdomain.zm

Contoh file passwd .zm

zmprov ma yudi.handoko@testdomain.com userPassword '{crypt}$6$40186242$89MpB6dPuCOY8XssTdyj9xE78QIU0sDRV5qFfsc7gdgeBrwjvuJ8HA1bU/sWK9MoFKFS5v4tDf/YF1ZmxUuc0/'

C. Restore Mailbox Account Server Lama ke Server Baru

1. Siapkan user dan password setiap account di Server lama dan Server baru.

2. Jalankan script di Server lama

[root@mail1:~]# imapsync --host1 localhost --user1 anton.prasetyo.testdomain --password1 xxxx --authmech1 PLAIN --host2 117.102.94.158 --user2 anton.prasetyo@testdomain.com --password2 xxxx --authmech2 PLAIN --ssl2 --allowsizemismatch –-nofoldersizes --skipsize –-fast

script shadow2zm.pl =========================================================

#!/usr/bin/perl
# Usage: as root   # ./shadow2zm.pl /etc/shadow > shadow.zm
#        as zimbra # zmprov < shadow.zm

$domain="testdomain.com";

while(<>) {
    chomp;
    my ($uname,$pass) = split(/:/);

    print qq{zmprov ma $uname\@$domain userPassword '{crypt}$pass'\n};
    print qq{\n};
}

script passhadow2zm.pl =======================================================

#!/usr/bin/perl

#
# $Id: passwd2zmprov,v 1.2 2008/03/05 05:01:29 phil Exp $

=head1 NAME

passwd2zmprov - create zmprov commands from a passwd file

=head1 SYNOPSIS

  usage: passwd2zmprov [options] [[passwd_file] ...] > commands.zmp
     -help   show a brief help message
     -man    show the full documentation

     -domain      [REQUIRED]
     -cosid       [default "Default COS"]
     -password  [default ""]

  Getting a COS id:
    zimbra$ zmprov gc  | grep ^zimbraId:

  Example converting CSV to zmprov commands:
    $ ./passwd2zmprov -domain example.moc /etc/passwd > commands.zmp

  Example provisioning ZCS accounts as 'zimbra' user:
    zimbra$ zmprov -f commands.zmp

=head1 DESCRIPTION:

Tool to create commands suitable for zmprov from a UNIX passwd file.
We don't use getpwent etc., because we are likely working on a copy
and not running as root.

See Also:
  http://wiki.zimbra.com/index.php?title=Bulk_Create

=cut

use strict;
use warnings;
use File::Basename qw(basename);
use Getopt::Long qw(GetOptions);
use Pod::Usage qw(pod2usage);

my $prog = basename($0);
my ( @err, %option );

GetOptions( \%option, 'help|?', 'man', 'domain=s', 'cosid=s', 'password=s' )
  or pod2usage( -verbose => 0 );

pod2usage( -verbose => 1 ) if $option{help};
pod2usage( -verbose => 2 ) if $option{man};

push( @err, "-domain  is required" )
  unless $option{domain};

pod2usage( -verbose => 0, -message => map( "$prog: $_\n", @err ) )
  if @err;

warn("$prog: using Default COS\n") unless $option{cos_id};
warn("$prog: reading passwd like entries from STDIN\n") unless @ARGV;

my $date     = localtime;
my $cosid    = $option{cosid};
my $domain   = $option{domain};
my $password = defined $option{password} ? $option{password} : "";
my $MIN_UID = 500;      # skip system accounts like httpd
my $MAX_UID = 60000;    # skip other system accounts like nfsnobody

# sanitize password
$password =~ s/\"/\\\"/g;

while (<>) {
    chomp;
    next if /^\s*$/;    # skip empty lines

    my ( $uname, $x, $uid, $gid, $gecos, $dir, $shell ) = split( /:/, $_, 7 );

    if ( $uid < $MIN_UID or $uid > $MAX_UID ) {
        warn("$prog: skip $uname: $uid not between $MIN_UID and $MAX_UID\n");
        next;
    }

    # assuming gecos format is First [[MI] [Last]], sanitize a little
    $gecos =~ s/\"/\\\"/g;

    my ( $fullname, $description ) = split( /\s*,\s*/, $gecos, 2 );
    my ( $fname, $mname, $lname ) = split( " ", $fullname, 3 );
    unless ( defined($lname) ) {
        $lname = $mname;
        undef($mname);
    }
    my $displayname = $fname
      . ( defined($mname) ? " $mname" : "" )
      . ( defined($lname) ? " $lname" : "" );

    print(
        qq{ca "$uname\@$domain" "$password"},
        ( defined($cosid)       ? qq{ zimbraCOSid "$cosid"}       : () ),
        ( defined($fname)       ? qq{ givenName "$fname"}         : () ),
        ( defined($lname)       ? qq{ sn "$lname"}                : () ),
        ( defined($uname)       ? qq{ cn "$uname"}                : () ),
        ( defined($displayname) ? qq{ displayName "$displayname"} : () ),
        ( defined($description) ? qq{ description "$description"} : () ),
        qq{ zimbraNotes "Migrated $date"},
        qq{ zimbraPasswordMustChange TRUE},
        qq{\n},
    );
}

=head1 HISTORY

 2007/01/23, Version 1.0/1.1 Dlbewley
 2008/03/04, Version 1.2 Plobbes

=cut

D. Menampilkan List Address Book di semua Domain

su -l zimbra -c "zmprov mcf zimbraGalInternalSearchBase ROOT"

#Keane-Somewhere Only We Know

"Somewhere Only We Know"

 

I walked across an empty land
I knew the pathway like the back of my hand
I felt the earth beneath my feet
Sat by the river and it made me complete

Oh simple thing where have you gone?
I'm getting old and I need something to rely on
So tell me when you're gonna let me in
I'm getting tired and I need somewhere to begin

I came across a fallen tree
I felt the branches of it looking at me
Is this the place we used to love?
Is this the place that I've been dreaming of?

Oh simple thing where have you gone?
I'm getting old and I need something to rely on
So tell me when you're gonna let me in
I'm getting tired and I need somewhere to begin

And if you have a minute why don't we go
Talk about it somewhere only we know?
This could be the end of everything
So why don't we go
Somewhere only we know?
Somewhere only we know?

Oh simple thing where have you gone?
I'm getting old and I need something to rely on
So tell me when you're gonna let me in
I'm getting tired and I need somewhere to begin

And if you have a minute why don't we go
Talk about it somewhere only we know?
This could be the end of everything
So why don't we go?
So why don't we go?

 This could be the end of everything
So why don't we go
Somewhere only we know?
Somewhere only we know?
Somewhere only we know?