OXSE4UCS Installation en

Introduction

The Open-Xchange Advanced Server Edition (OXASE)/Open-Xchange Server Edition for Univention Corporate Server (OXSE4UCS) includes the groupware Open-Xchange and the integration packages for Univention Corporate Server (UCS).

Open-Xchange Advanced Server Edition (OXASE)/Open-Xchange Server Edition for Univention Corporate Server (OXSE4UCS) is tailored to professional users looking for a tried-and-tested solution for the management of their entire IT infrastructure including groupware or companies which already employ UCS and wish to expand their infrastructure with innovative groupware functions.

More detailed information on UCS can be found on the Univention GmbH website: http://www.univention.de/dokumentation.html.

Differences between OXASE and OXSE for UCS

OXASE can not be used as

• Domain Controller
• Print Server
• Database, web or directory service server (unless not for the exclusive use with Open Xchange)
• IP management system
• Software distribution system
• Network or service monitoring system
• Management tool for Windows or Linux based systems

Except for

• the provisioning, use and management of file services („shares“) with the Samba software
• the temporary, three-months limited, non-productive use of UCS for evaluation purposes

First Step: Installation Univention Corporate Server

As OXASE/OXSE4UCS is an expansion pack for the Univention Corporate Server, one or more UCS server(s) must be installed firstly. There are several possible different installation scenarios. In principle, OXASE/OXSE4UCS can be installed on all UCS domain controller server roles: DC master, DC backup or DC slave. Installation on the server roles member server or base system is not currently possible.

To start, the Univention Corporate Server systems are installed as usual with UCS 2.4. The download link for the installation of the Univention Corporate Server system is provided at your Email purchase information.

If these information isn't available, you have the possibility to download the Univention Corporate Server Free-For-Personal-Use-Version under http://www.univention.de/en/download/free-for-personal-use-edition/download/. After registration of your Univention license key or license file authorizes the use of the respective Univention components of the purchased product for the respective license agreement.

If several systems are in the UCS domain, a check must be performed that the join procedure has been run on all servers. This is usually done at the end of the installation procedure. Further information on the installation of UCS can be found in the UCS manual: http://www.univention.de/dokumentation.html

Second Step: Installation Open-Xchange Advanced Server Edition / Server Edition

The password-protected Open-Xchange repository must be integrated on all the systems where OXASE/OXSE4UCS packages are to be installed. The following Univention Configuration Registry variables (UCR variables) can be used to do this:

$ export LDBUSER=”myusername” LDBPASS=”secret”
$ ucr set repository/online/component/ox/server=software.open-xchange.com \
	repository/online/component/ox/prefix=OX6/OXSEforUCS \
	repository/online/component/ox/username=”$LDBUSER” \
	repository/online/component/ox/password=”$LDBPASS” \
	repository/online/component/ox/version=current \
	repository/online/component/ox=enabled \
	repository/online/component/oxseforucs/server=software.open-xchange.com \
	repository/online/component/oxseforucs/prefix=OX6/OXSEforUCS \
	repository/online/component/oxseforucs/username=”$LDBUSER” \
	repository/online/component/oxseforucs/password=”$LDBPASS” \
	repository/online/component/oxseforucs/version=current \
	repository/online/component/oxseforucs=enabled

The access data (myusername and secret) are created when the Open-Xchange licence is activated and must be adapted here accordingly.

Installation on a DC master

When installing OXASE/OXSE4UCS on a DC master, only the univention-ox-meta-singleserver package requires installing. This can be performed via the Univention Management Console or on the command line:

  $ univention-install univention-ox-meta-singleserver

The univention-ox-meta-singleserver package automatically installs packages for the filtering of spam and viruses at the same time. If this is not required, the univention-ox and univention-mail-cyrus-ox packages can be installed instead of the univention-ox-meta-singleserver package.

Installation on a dedicated DC slave

In this installation scenario, the DC slave system acts as a standalone Open-Xchange groupware server. To start, the univention-ox-directory-integration package must be installed on the DC master in order to initiate integration in the UCS management system.

 $ univention-install univention-ox-directory-integration
 $ univention-actualise

The univention-ox-meta-singleserver package is installed on the DC slave which is to be used as the groupware server. In addition, the join scripts must also be run following the installation:

$ univention-install univention-ox-meta-singleserver
$ univention-actualise
$ univention-run-join-scripts

The univention-ox-meta-singleserver package automatically installs packages for the filtering of spam and viruses. If this is not required, the univention-ox and univention-mail-cyrus-ox packages can be specified instead of the univention-ox-meta-singleserver package.

Installation in a distributed environment

When installing a distributed environment, integration in the UCS management system must be performed firstly by installing univention-ox-directory-integration on DC Master.

$ univention-install univention-ox-directory-integration
$ univention-actualise                                  

The following services can then be distributed on the other UCS systems:

• IMAP server and optionally spam and virus filtering (univention-mail-cyrus-ox and optionally univention-mail-antispam-ox and univention-antivir-mail)
• MySQL server (mysql-server)
• OX instance (univention-ox)

MySQL server

The MySQL server is installed by installing the mysql-server package.

$ univention-install mysql-server
$ univention-actualise                                           

The configuration of the MySQL server should be set so that the MySQL service can be accessed via the external network interfaces. To do this, for example, the bind-address option can be set to 0.0.0.0 in the MySQL configuration file /etc/mysql/my.cnf.

bind-address 0.0.0.0                                                             

After the change, the MySQL service needs to be restarted:

$ /etc/init.d/mysql restart

In addition, the OX instances must be authorized to access the database. The following gives an example, which must be adapted to the environment at hand.

$ mysql                                                                            
mysql> GRANT ALL PRIVILEGES ON *.* TO \                                          
 'openexchange'@'ox-instance1.example.com' \                                       
 IDENTIFIED BY 'secret';                                                         
mysql> GRANT ALL PRIVILEGES ON *.* TO \                                          
 'openexchange'@'ox-instance2.example.com' \                                       
 IDENTIFIED BY 'secret';                                                         
mysql> GRANT ...                                                                 
mysql> FLUSH PRIVILEGES;                                                         
mysql> exit                           
$

Active OX instance

The univention-ox package must be installed on the active OX instance.

$ univention-install univention-ox
$ univention-actualise                                                    

Then certain environment variables must be set to ensure that the join scripts run later receive the corresponding permissions. The following gives an example, which must be adapted to the environment at hand. The variable OXDB defines the MySQL server to be used by the OX instance. The corresponding password should be saved in the variable OXDBPW. The standard IMAP server must be specified in the variable OXIMAPSERVER. Hostnames need to be specified as fully qualified domain names (FQDN). It is not possible to use IP addresses.

$ export HISTIGNORE="export*"
$ export OXDB=oxdbserver.ucs.local
$ export OXDBPW="secret"
$ export OXIMAPSERVER=oximapserver.ucs.local                                 

Then the join scripts need to run:

$ univention-run-join-scripts

Finally, the environment variable OXDBPW with the password can be unset using the following command:

$ unset OXDBPW

IMAP server

The IMAP server is installed by installing the univention-mail-cyrus-ox package.

$ univention-install univention-mail-cyrus-ox

The spam check via spamassassin can be installed and activated by installing the univention-mail-antispam-ox package:

$ univention-install univention-mail-antispam-ox

The virus check via amavis and clamav can be installed and activated by installing the univention-antivir-mail package.

$ univention-install univention-antivir-mail                                  

A check should then be performed to see whether all join scripts have been run successfully:

$ univention-actualise
$ univention-run-join-scripts

Additional passive OX instances

Firstly, the univention-ox package must also be installed on the additional passive OX instances.

$ univention-install univention-ox
$ univention-actualise                                                                                                                    

Then the settings can be copied from the active OX instance. This can be done, for example, using the following command:

$ rsync -essh -a root@ox-instance1.ucs.local:/opt/open-xchange/. /opt/open-xchange/

The FQDN of the current computer must be entered in the /opt/open-xchange/etc/groupware/usm.properties file:

com.openexchange.usm.ox.url=ox-instance2.ucs.local

The FQDN of the current computer must also be entered in the /opt/open-xchange/etc/authplugin.properties file:

LDAP_HOST=ox-instance2.ucs.local

Finally, the groupware must be restarted on the passive OX instance:

$ /etc/init.d/open-xchange-admin restart
$ /etc/init.d/open-xchange-groupware restart

OXtender for Business Mobility

The Open-Xchange OXtender for Business Mobility is an optionally available component for OXASE/OXSE4UCS which enables the connection of mobile devices. The repository must be activated for it to be possible to install the corresponding packages:

$ export LDBUSER="ldbuser" LDBPASS="lsbpass"
$ ucr set repository/online/component/oxmobility/server=software.open-xchange.com \
	repository/online/component/oxmobility/prefix=OX6/OXSEforUCS \
	repository/online/component/oxmobility/username="$LDBUSER" \
	repository/online/component/oxmobility/password="$LDBPASS" \
	repository/online/component/oxmobility/version=current \
	repository/online/component/oxmobility=enabled

Installing the univention-ox-usm-ox package installs the Oxtender for Business Mobility on the OXASE/OXSE4UCS system.

$ univention-install univention-ox-usm-ox
§ reboot

If the target system is neither a DC master nor a DC backup system, the univention-ox-usm-udm package should also be installed on the DC master.

$ univention-install univention-ox-usm-udm

Updating

To update a UCS 2.3-2 system with OXASE/OXSE4UCS 6.16 to 6.18.1 with UCS 2.4, the following variables must be set before the update.

$ ucr set repository/online/component/ox/version=current \
	repository/online/component/oxseforucs/version=current

The system can then be updated as usual for UCS using the univention-updater net command or the UMC module Online Update.

Administration

UMC module “Licence management”

Alongside the configuration of the Open-Xchange account, the UMC module “Licence management” can also be used to set a maintenance key and for the simplified import of a licence file.

The configuration of an Open-Xchange account is necessary to be able to import version and software updates for OXSE for UCS via the UMC module “Online updates”, as the online repositories require an authentication. In this case, the user data (user name and password) required are the same as those which were also used for the licence database (http://ldb.open-xchange.com).

Once the account has been added via the Add account button, the OXSE for UCS is configured automatically for a subsequent online update. The account can be altered subsequently via the Change account button.

When adding/changing an account, the user name and password entered are verified automatically. This is done by connecting to the licence database. To reset the password for an account, the Request password reset button can be used to reset the password for the specified account. The user name must be entered in the dialogue which opens; the password must be entered twice. On confirmation, an e-mail is sent to the e-mail address specified for the account containing a confirmation link, which can be opened in the browser to complete the process.

Alongside specification of an Open-Xchange account, it is also possible to select a licence key at this stage, which was saved automatically on the Open-Xchange account on its activation. The licence key is selected using the Change licence key button.

A variety of licence information for a licence key is stored in the licence database (e.g., LDAP basic DN or the number of licensed users). The Update licence button is used to request this licence information online in the form of a licence file initially after the installation or following subsequent licensing and import it automatically into the management system.

You may be requested to accept the current end user license agreement (EULA) at this stage. If the EULA has already been accepted, e.g., via the (http://ldb.open-xchange.com) license database, this step is bypassed automatically. In the case of a EULA update, it may be necessary to confirm the EULA anew at a subsequent point in time. Once licensing is completed, the Switch to online update module button can be used to open the module for importing version and security updates.

User and group management

New users and groups can be created using the Univention Directory Manager (UDM). The UDM can be accessed on the DC master via a web browser at https://<IP address of DC master>/udm/. It is possible to log in as the Administrator user using the password specified during the installation.

When creating a user, the open-xchange groupware account user template should be selected. This preselects all Open-Xchange specific settings.

System messages

The mail/alias/root UCS variable must be set so that system messages can be delivered. To do this, either a new account can be created or, alternatively, oxadmin@DOMAIN is provided for this purpose:

$ ucr set mail/alias/root=oxadmin@ucs.local
$ newaliases
$ /etc/init.d/postfix reload

It is possible to log in as the oxadmin user in the Open-Xchange web interface using the password from the /etc/ox-secrets/context10.secret file.