Zimbra – System Requirement for CentOS

• A domain name
• A cloud, VPS, or dedicated server based on your need.

But your system should meet the following minimum configuration as per the Zimbra documentation.

• CPU – 1.5 Ghz
• Memory – 8 GB
• Storage – 5 GB for ZCS installation

Initial Domain Setup

First of all create 2 DNS entries in the domain records as follows

Initial Server Setup

First of all, switch to root user, just in case if you not working as root user.

Disable SElinux

After that disable SElinux. Though it is great for OS security it will interfere with our installation. Later, we will enable the firewall on our system. To do that, open the /etc/selinux/config file.

Edit the content below.

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

# enforcing – SELinux security policy is enforced.

# permissive – SELinux prints warnings instead of enforcing.

# disabled – No SELinux policy is loaded.

SELINUX=disabled

# SELINUXTYPE= can take one of these two values:

# targeted – Targeted processes are protected,

# minimum – Modification of targeted policy. Only selected processes are protected.

# mls – Multi Level Security protection.

SELINUXTYPE=targeted

Set up hostname

You must set up hostname for the server before installing. Your domain is yourdomain.com, so you should set hostname for the server is mail.yourdomain.com.

Set up hosts file

You also need to set the server’s /etc/hosts file. Open the file and add the following content.

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4

192.168.10.10 mail.yourdomain.com mail

Set up network card

Suppose your server has a public card on the internet named ens192. Open its configuration file and make sure DNS1 is your server’s IP.

Content like below.

HWADDR=00:51:56:a3:e3:d9

NAME=ens192

GATEWAY=192.168.10.1

DNS1=192.168.10.10

DNS2=8.8.8.8

DNS3=8.8.4.4

DEVICE=ens192

ONBOOT=yes

USERCTL=no

BOOTPROTO=static

NETMASK=255.255.255.0

IPADDR=192.168.10.10

PEERDNS=no

Then, type the following command to restart the network service.

Check the file /etc/resolv.conf

After restarting the network service, check the /etc/resolv.conf file to make sure DNS1 is always your own mail server.

If the answer of resolv.conf is not the same as above then edit it, and make the changes.

Perhaps more than 90% of Zimbra installation errors are related to DNS issues. Therefore, if you do not do this correctly, your mail server will fail.

Reboot your server

After you have done all the above preparation steps correctly, you must reboot the server (to SElinux disable).

Simply type the reboot command.

Install DNS for Zimbra mail server

I have encountered many errors when installing Zimbra, the main reason is due to DNS. Basically, Zimbra comes with Zimbra-DNS Cache package, which will install local DNS on your MTA server. This helps queries out the internet faster.

However, we are installing single server, so the MTA is in a single server. Therefore, before installing Zimbra, we need to install the DNS server and it will be right on the Zimbra mail server.

Now, use the following command to install DNS packages.

Configure /etc/named.conf file

Next, you edit the /etc/named.conf file as follows.

//

// named.conf

//

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

//

// See /usr/share/doc/bind*/sample/ for example named configuration files.

//

// See the BIND Administrator’s Reference Manual (ARM) for details about the

// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {

listen-on port 53 { 127.0.0.1; 192.168.10.10; };

listen-on-v6 port 53 { ::1; };

directory “/var/named”;

dump-file “/var/named/data/cache_dump.db”;

statistics-file “/var/named/data/named_stats.txt”;

memstatistics-file “/var/named/data/named_mem_stats.txt”;

recursing-file “/var/named/data/named.recursing”;

secroots-file “/var/named/data/named.secroots”;

allow-query { localhost; 192.168.10.10; };

/*

– If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

– If you are building a RECURSIVE (caching) DNS server, you need to enable

recursion.

– If your recursive DNS server has a public IP address, you MUST enable access

control to limit queries to your legitimate users. Failing to do so will

cause your server to become part of large scale DNS amplification

attacks. Implementing BCP38 within your network would greatly

reduce such attack surface

*/

recursion yes;

dnssec-enable yes;

dnssec-validation yes;

/* Path to ISC DLV key */

bindkeys-file “/etc/named.iscdlv.key”;

managed-keys-directory “/var/named/dynamic”;

pid-file “/run/named/named.pid”;

session-keyfile “/run/named/session.key”;

forwarders { 8.8.8.8; };

};

logging {

channel default_debug {

file “data/named.run”;

severity dynamic;

};

};

zone “.” IN {

type hint;

file “named.ca”;

};

zone “yourdomain.com” {

type master;

file “yourdomain.com.zone”;

};

include “/etc/named.rfc1912.zones”;

include “/etc/named.root.key”;

Please note the following in /etc/named.conf.

• listen-on port 53 { 127.0.0.1; 103.95.198.193; }; : Add your server’s IP to this line
• allow-query     { localhost; 103.95.198.193; }; : Add your server’s IP to this line
• forwarders { 8.8.8.8; }; : Add this line at the end of the options block
• At last, add a zone (as shown below) for your domain (at the place as shown above).

zone “yourdomain.com” {

type master;

file “yourdomain.com.zone”;

};

Create a domain zone file

Now, you have to create the file zone for the domain using the following command.

After that, add the following content to the file and save it, note the edit information for matching your server and domain.

;

; BIND data file for local loopback interface

;

$TTL 86400

@ IN SOA ns1.yourdomain.com. root.yourdomain.com. (

2021051001 ; Serial

604800 ; Refresh

86400 ; Retry

2419200 ; Expire

604800 ) ; Negative Cache TTL

;

; name servers – NS records

@ IN NS ns1.yourdomain.com.

@ MX 10 mail.yourdomain.com.

; name servers – A records

ns1 IN A 192.168.10.10

mail IN A 192.168.10.10

Start the DNS service and check the record

Next, type the following command to enable and start the DNS service.

You can then check the record with the following 2 commands.

Install Zimbra

Remove Postfix and install dependencies

First, you need to turn off the Postfix service if it is running and then disable it. Just run the following command and it will do both.

Next, you type the below command to install dependencies for Zimbra.

Download the package and install Zimbra 8.8.15 in CentOS 8

First, we will create a folder called zimbra. This folder is for downloading the Zimbra installation package to your server.

Next, type the following command to download the Zimbra package 8.8.15 to the server.

Then, extract the installation package.

Now, move to the unzipped folder.

And finally, type the following command to install Zimbra 8.8.15.

The installation process will take place as below.

Agree with the terms of Zimbra. Type Y.

Next, allow to user Zimbra’s package repository.

After that, type Y to select packages you want to install. We will install these packages: zimbra-ldap, zimbra-logger, zimbra-mta, zimbra-snmp, zimbra-store, zimbra-apache, zimbra-spell, zimbra-memcached, zimbra-proxy.

There are some packages optional: zimbra-drive (use with NextCloud), zimbra-imapd (still BETA), zimbra-chat (not really necessary, users often chat via Skype or some thing like that).

Now, you might want to ask why for zimbra-dnscache, we choose N. Because we installed the DNS server on the Zimbra server, so we don’t need to install it anymore. If you select Y to install zimbra-dnscache, the installation will fail.

After the above step next, you have to type Y to confirm that the system will be modified and the installation will begin.

Now, it will tell you DNS error resolving MX for mail.yourdomain.com. Answer yes to change domain then type your domain name as shown below.

The main menu displays for some subsequent settings.

Choose number 6.

Then choose number 4 and type your new password for admin account.

And type r to return previous menu.

Then type a to apply configuration.

At last installation will begin and you just need to wait about 5-10 minutes for it to finish.

After the installation has finished, you switch to user Zimbra to check the Zimbra service status.

Open the firewall port for Zimbra

For CentOS 7, it uses firewalld. Type the following commands to open the necessary ports for Zimbra.

Warning: Note that port 7071 is for admin.

Access the Zimbra admin for the first time

Now, open your browser and type in the url: https://mail.yourdomain.com:7071

Then, login your admin account.

Notice the upper right corner of the window, the Service section should be Running. Or you can wait for 1-2 minutes for the window to update the status.

If you still don’t run, you need to restart the Zimbra service.

Post Installation Configurations:

You need to do some post-installation configurations, though not mandatory it’s advisable to do so. When we install Zimbra it creates a system user Zimbra with a disabled password. Actually, it uses ssh keys to connect. Therefore, we need to update the ssh keys as follows.

Now, to display server statistics on the Admin console, we need to update the Syslog configuration files as follows.

If you working as Zimbra user exit (execute command exit) to switch to root user and execute the following command.

It’s desirable to enable automatic scanning of email attachments using ClamAV antivirus. Therefore, execute the following command.

Final Domain Setup

In the beginning, we already created 2 DNS records. But, we also need to create DKIM, DMARC, SPF records as well as finish the setup. Let’s begin.

Generate DKIM key on Zimbra

First, you need to switch to Zimbra user with the following command.

Now, to add DKIM data to the new domain, run the following command.

The result of the command will look like this.

So, now DKIM key has been generated, it’s time to add it to DNS records.

If you want to retrieve, update or delete DKIM key in the future you can check the detailed guide on  DKIM page of Zimbra. I just demonstrated one use of zmdkimkeyutil tool that allows you to create, update, query, and delete DKIM of a domain in Zimbra.

Create DMARC record for Zimbra

You can create DMARC record either online or manually. To generate DMARC records online you can follow this article. For manual creation just copy the following record and don’t forget to replace yourdomain.com

Create SPF record for Zimbra

Once again to create SPF record online you can follow my article or to create it manually, just copy the following record and edit the domain name and IP address.

Home

Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem. Nulla consequat massa quis enim.

Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus.

Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem. Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo. Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi.

Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim. Aliquam lorem ante, dapibus in, viverra quis, feugiat a, tellus. Phasellus viverra nulla ut metus varius laoreet.

• Quisque rutrum. Aenean imperdiet.
• Etiam ultricies nisi vel augue.
• Curabitur ullamcorper ultricies nisi.
• Nam eget dui. Etiam rhoncus.

[quote float=”left”]Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim.[/quote] Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem. Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo. Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi.

Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem.

Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo.

Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus.

Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem.

Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo.

Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi. Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim. Aliquam lorem ante, dapibus in, viverra quis, feugiat a, tellus.

[quote float=”left”]Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massculus mus.[/quote] Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem.

Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo.

Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi. Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim. Aliquam lorem ante, dapibus in, viverra quis, feugiat a, tellus.

Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi. Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim. Aliquam lorem ante, dapibus in, viverra quis, feugiat a, tellus.

Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem.

Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo.

Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi. Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim. Aliquam lorem ante, dapibus in, viverra quis, feugiat a, tellus.

Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem.

Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo.

Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi. Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim. Aliquam lorem ante, dapibus in, viverra quis, feugiat a, tellus.

Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi

Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi