Running ISPMAN on Debian 3.0 Full Install Guide
Overview of the process:
A) Configure and install ISPMAN, populate LDAP for a first time install B)
Log into the ISPMAN web interface, then finish configuring ISPMAN C) Setup
ISPMAN agents with a /etc/init.d/ispman-agent startup script D) Configure
each application to work with the ISPMAN agent or the LDAP information

Preinstallation checklist:

apt-get install libdigest-md5-perl cvs slapd
 Directory initialization method: auto
 Directory suffix style: custom 
 Enter your suffix:  o=ispman
 Passwd: xxxxxx   <-- needs to match LDAP password during compile
 Replicate to another LDAP server: No

ISPMAN Primary Server Setup Notes:

1. creat a user called ispman
2. "chown ispman /opt" and "cd /opt"
3. login as ispman and download the latest ispman-someversion.tar.gz to /opt
4. tar zxf ispman-someversion.tar.gz 
5. cd ispman-someversion
6. cvs -z3 update -dP    
7. ./configure
  Accepted all defaults except:
   Domain is azxws.com
   LDAP directory is /etc/ldap
   set ldap password
   set cyrus password

8. "make ispman"
FIRST TIME INSTALL ONLY (EMPTY LDAP TREE)
NOTE: This will WIPE out an existing ispman installation.
 A. AS ROOT: cp /opt/ispman-someversion/tmp/conf/slapd.conf
/etc/ldap/slapd.conf B. AS ROOT: cp
/opt/ispman-someversion/tmp/conf/schema/* /etc/ldap/schema/ C.
/etc/init.d/slapd restart D. make ldif_install

9. make install_ispman_common
10. make install_ispman_web
11. Setup ispman web access:
  A. AS ROOT: apt-get install apache apache-ssl
  B. Modify /etc/apache-ssl/httpd.conf with
       Include /etc/ispman/apache.conf
  C. Create the file /etc/ispman/apache.conf like so:

/----- /etc/ispman/apache.conf ---
Alias /ispman /opt/ispman/htdocs

    Options ExecCGI
    AddHandler cgi-script .cgi
    DirectoryIndex index.html index.cgi
    AllowOverride None

\------ end apache.conf --------

  D. /etc/init.d/apache-ssl restart

You should now be able to access ISPMAN at
https://ip.add.re.ss/ispman/ 

If unable to access the website, check /var/log/apache_ssl/error_log and fix
it..

----ISPMAN Web Configuration --
Login using the name ispman with the LDAP password entered above.

Click Configuration, make sure to setup hosts and host groups.

ISPMAN - Apache Configuration
 Apache stop command - /etc/init.d/apache stop
 Webalizer command - /usr/bin/webalizer
 Apache vhost file - /etc/apache/vhosts.conf
   (Must add "Include /etc/apache/vhosts.conf" to apache's httpd.conf)
 Apache start command - /etc/init.d/apache start
 Apache graceful reload command - /etc/init.d/apache reload
 Default vhost IP -- * (Allows it to work on any machine)
 Apache reload command - /etc/init.d/apache reload


ISPMAN - Mail Configuration
 IMAP server - cyrus
 Server Maps command - /usr/sbin/postmap
 SMTP reload command - /etc/init.d/postfix reload
 Map files directory - /etc/postfix
 Mailbox Prefix - user.

DNS Config:
 Named Start Command - /etc/init.d/bind start
 Primary DNS (name) - ns1.domain.com
 ISPMan's DNS data directory -  ispman/
 Primary Mail Server (name) - mail.domain.com
 Named data directory - /var/named  
 Secondary Mail Server (IP) - xxx.xxx.xxx
 DNS Backend - bind8
 Secondary DNS (IP) - xxx.xxx.xxx.xxx
 Reverse Zone directory - rev/
 Header file for named.conf - /opt/ispman/templates/named.conf.header Named
Reload Command - /etc/init.d/bind reload Footer file for named.conf -
/opt/ispman/templates/named.conf.footer Named Stop Command -
/etc/init.d/bind stop Secondary Zone directory - sec/ Named Config File  -
/etc/named.ispman.conf
 Primary DNS (IP) - xxx.xxx.xxx.xxx
 Secondary Mail Server (name) - mail2.domain.com
 Secondary DNS (name) - ns2.domain.com
 Primary Mail Server (IP) - xxx.xxx.xxx.xxx
 Catch all CNAME  - none
 Primary Zone directory - pri/
 Hostmaster's email address - hostmaster.domain.com
 Named User - root 

Set up additional users if desired.

--ISPMAN-AGENT---

1) apt-get install daemontools-installer, when asked DO make the /service
directory  2) mkdir /etc/ispman 
3) edit /etc/ispman/run like so:

/---- /etc/ispman/run ----
#!/bin/sh
exec Starting ispman agent
exec /opt/ispman/bin/ispman-agent nodetach
\----- end file -----

4) ln -s /etc/ispman /service/
5) ln -s /opt/ispman/var/ /var/log/ispman/
6) edit /etc/init.d/ispman-agent like so:

/--------/etc/init.d/ispman-agent----
#!/bin/sh
#     * svc -h /service/yourdaemon: sends HUP
#     * svc -t /service/yourdaemon: sends TERM, and automatically restarts
the #       daemon after it dies #     * svc -d /service/yourdaemon: sends
TERM, and leaves the service down #     * svc -u /service/yourdaemon: brings
the service back up #     * svc -o /service/yourdaemon: runs the service
once daemon="/service/ispman"
process="ispman"
name="ispman-agent"

case "$1" in
    start)
        echo -n "Starting $name:"
        svc -u $daemon
        echo  " started"
        ps aux | grep $process
        ;;
    stop)
        echo -n "Stopping $name:"
        svc -d /service/ispman
        echo  " stopped"
        ps aux | grep $process
        ;;
    restart|force-reload)
        echo -n "Restarting $name:"
        svc -t $daemon
        echo " restarted"
        ;;
    reload)
        echo -n "Reloading $name:"
        svc -h $daemon
        echo " reloaded"
        ;;
    status)
        echo -"Getting Status... Jobs in queue: "
        /opt/ispman/bin/ispman.processes -h $HOSTNAME
        ;;
    *)
        echo 'Usage: /etc/init.d/ispman
{start|stop|restart|force-reload|reload|
status}'
        exit 1
esac

exit 0
\--------/etc/init.d/ispman-agent----

NOTE: I had to edit /opt/ispman/bin/ispman.processes and tell it the
ispman/lib path.

7) chmod +x /etc/init.d/ispman-agent
8) /etc/init.d/ispman-agent start
tail the logs in /var/log/ispman/ to see whats happening.
The biggest problem with agents not completing tasks is that the hostname
does not match. Checking the syslog will show what hostname the agent looks
for. 

9) update-rc.d defaults ispman-agent 99


NOTE: Do above steps sans web configuration stuff for each machine
participating in the net. It should also be possible to just copy
/opt/ispman sans the htdocs dir to each server.

--LDAP setup ---

YOU MUST HAVE A NEWLINE AFTER YOUR ENTRIES OR THIS WON'T WORK. This secures
LDAP from foreign queries. Feel free to add LDAP ACL and iptable rules too.
You need to setup your own replication servers.

1) Edit /etc/hosts.allow adding: 
slapd: XXX.XXX.XXX.XXX 127.0.0.1 : ALLOW


2) Edit /etc/hosts.deny adding:
slapd: ALL : DENY

NOTE: test using ldapsearch locally and from a remote machine not in the
allowed file. 

3) Test it like so (requires ldap-utils package)
   ldapsearch -xvu -LLL -b "o=ispman" ispmanVar=*

--PAM_LDAP setup ---
This basically allows any daemon using PAM for authentication to use LDAP.
Some programs like Cyrus don't authenticate directly from LDAP without
patches. This lets them 'ask' PAM for authentication. PAM then acts as an
'LDAP proxy' finding out authentication information and and returns the
answer in an understandable way.  

1) make sure libpam-ldap is installed
(apt-get install libpam-ldap)
 make configuration readable/writeable by owner only: Yes 
 Make local root Database admin: No 
 Database requires logging in: No 
 Local crypt to use when changing passwords: crypt

2) Edit /etc/pam_ldap.conf like so:
host 127.0.0.1   <--- will differ if the LDAP server is elsewhere.  base
o=ispman 
ldap_version 3
pam_password crypt


--CYRUS/IMAP/POP3D---
This includes setup guides for Cyrus 1.5 which is in the stable branch and
Cyrus2.1 which is official, but is backported. Cyrus 1.5 is easier to setup,
but lacks SSL support and sieve mail sorting. The /var/spool/cyrus directory
layout of 2.xx is designed for large installations. Authentication depends
on different daemons, but thanks to pam support, they both work easily with
an ISPMAN LDAP site.

CYRUS 2.1 instructions 
1) Add these line to /etc/apt/sources.list
  #Cyrus21 Backports
  deb http://people.debian.org/~hmh/woody/ hmh/cyrus/

2) apt-get update 

3) apt-get install cyrus21-pop3d cyrus21-common cyrus21-imapd cyrus21-admin
cyrus21-admin cyrus21-clients cyrus21-doc gawk libcyrus-imap-perl21 libsasl2
libsnmp-base libsnmp4.2 sasl2-bin libsasl2-modules libsasl2 and sasl2-bin

4) Edit the following lines in /etc/imapd.conf like so:

admins: cyrus
popminpoll: 0
allowplaintext: yes
sasl_minimum_layer: 0
sasl_mech_list: plain login
sasl_pwcheck_method: saslauthd
lmtp_downcase_rcpt: yes
tls_ca_file: /etc/ssl/cyrus.pem 
tls_cert_file: /etc/ssl/cyrus.pem 
tls_key_file: /etc/ssl/cyrus.pem

5) Edit /etc/cyrus.conf and allow lmtp localhost, imaps, and pop3s

6) Create SSL key and pem file for cyrus
  A. openssl req -new -nodes -out req.pem -keyout key.pem  
  B. openssl rsa -in key.pem -out new.key.pem
  C. openssl x509 -in req.pem -out ca-cert -req \
     -signkey new.key.pem -days 999 
  D. mv new.key.pem /etc/ssl/cyrus.pem
  E. cat ca-cert >> /etc/ssl/cyrus.pem
  F. chown cyrus.mail /etc/ssl/cyrus.pem
  G. chmod 600 /etc/ssl/cyrus.pem 

7) Edit /etc/pam.d/imap AND /etc/pam.d/pop like so:
auth    sufficient      pam_ldap.so 
account sufficient      pam_ldap.so

8) Add cyrus to the sasl group (adduser cyrus sasl)
 
9)  Now, configure saslauthd to use PAM mode and startup:
   Modify /etc/default/saslauthd so that it reads:
   start=yes
   MECHANISMS="pam"

  NOTE: I've seen configs where saslauthd goes straight to LDAP. 
  The example I followed didn't work, so I stuck with pam. YMMV.

10) Restart saslauthd and cyrus
  /etc/init.d/cyrus21 restart
  /etc/init.d/saslauthd restart

11) Test the setup by doing this:
   #cyradm --user cyrus localhost
   localhost password:  <--- compile time cyrus password
   localhost> lm   <-- lm shows installed mailboxes
   If you don't get a hostname> prompt, check the syslog for errors. Verify
LDAP is running.

   THEN the ultimate: Create a domain and verify connectivity!
   telnet localhost 110
   USER someuser_domain_com
   PASS password
   LIST (you should see all mail waiting.)
 


CYRUS 1.5 SETUP

1) edit /etc/imapd.conf, change the two lines listed like so:
   popminpoll:0 
   admins: cyrus

2) adduser --system cyrus  (may already exist)
3) passwd cyrus  (to whatever you set it up as in ./configure)

4) update-alternatives --config pwcheck 
   choose    2        /usr/sbin/pwcheck_pam

NOTE: Unless you stop pwcheck before this step, restarting it will leave you
with the old pwcheck_standard running. I do a killall pwcheck after this
step for good measure.

5) edit /etc/pam.d/cyrus so it says:
auth            sufficient              /lib/security/pam_ldap.so
account         sufficient              /lib/security/pam_ldap.so

6) test it! sample test for cyrus 1.5:
   #cyradm -u cyrus localhost
   localhost password:  <--- compile time cyrus password
   localhost> lm   <-- lm shows installed mailboxes

   If you get anything but a hostname> prompt, check the syslog and auth.log
for errors. Verify that pwcheck_pam is really running. Permission problems
in /var/lib/cyrus or /var/spool/cyrus can 'block' a cyradm session. If you
are still stuck, try strace'ing a pwcheck agent and see what it spits out. 
     
--BIND 8 SETUP--

1) apt-get install bind
2) Add this line to /etc/named/named.conf:

     include "/etc/named.ispman.conf";

NOTE: The ; at the end is critical, if it is dropped, you'll see a syslog
error like:
   /etc/bind/named.conf:67: parse error near 

3) Then as root: ln -s /etc/bind/ /var/named
ISPMAN likes to put stuff in /var/named/ispman/ so we make a symlink

4) Reload bind (/etc/init.d/bind reload) and check the logs, it should be
happy. 

--APACHE NOTES--
1) apt-get install squirrelmail apache apache-ssl
2) Edit /etc/apache/httpd.conf adding these lines: (change IPs and Server
Name)

UseCanonicalName Off  
NameVirtualHost * 
Include /etc/apache/vhosts.conf  < --- this is where the agent adds stuff
Include /etc/ispman/apache.conf  < --- this should still be in there

NOTE: With UseCanonicalName Off the server name comes from the contents of
the Host: header in the request.

2) if /etc/apache/vhosts.conf does not exist then (touch
/etc/apache/vhosts.conf) 3) /etc/init.d/apache restart

Check apache's logs, he should be happy. 

NOTE: ISPMAN uses an intermediate file in /etc/apache/vhosts.conf.hash file.
I've had to edit this file manually when a domain just wouldn't die.


--POSTFIX---
NOTE: postfix-snap packages are postfix 2.0 and some config options have
changed, this setup is for plain postfix

1) apt-get install postfix-ldap postfix-tls libsasl-modules-plain

2) Edit /etc/pam.d/smtpd like so:
auth    sufficient      pam_ldap.so 
account sufficient      pam_ldap.so

2) mkdir /etc/postfix/sasl and then create /etc/postfix/sasl/smtpd.conf like
so:  pwcheck_method: pam

3) Edit /etc/postfix/master.cf
Make sure smtpd is NOT chrooted -- This lets it do SMTP Auth.  
WARNING: SMTP Auth is an addon to postfix, it does decrease the overall
security.

4) Create TLS cert and key in /etc/postfix
   A. #openssl req -new -x509 -nodes -out cert.pem 
   B. chown root.postfix *.pem
   C. chmod 640 *.pem  

4) edit /etc/postfix/main.cf like so:

mailbox_transport=cyrus
mydomain = domain.com
myhostname = host.domain.com
program_directory = /usr/lib/postfix
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
# NOTE: myorigin MUST match the maildrop hostname in ISPMAN.
myorigin = /etc/mailname
relayhost = 
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

mydestination = $mydomain, $myhostname, localhost.$mydomain,
/etc/postfix/destination, hash:/etc/postfix/destination_domains
relay_domains = $mydomain, $myhostname, localhost.$mydomain,
/etc/postfix/destination, hash:/etc/postfix/relay_domains  #canonical_maps =
hash:/etc/postfix/canonical
virtual_maps = ldap:ldapvirtual

default_transport = smtp

ldapvirtual_server_host = localhost
ldapvirtual_server_port = 389
ldapvirtual_bind_dn = o=ispman
ldapvirtual_bind = no
ldapvirtual_timeout =

ldapvirtual_search_base = o=ispman
ldapvirtual_query_filter = (|(mailLocalAddress=%s)(mailAlias=%s))
ldapvirtual_result_attribute = mailRoutingAddress,mailForwardingAddress
ldapvirtual_lookup_wildcards = no

#relocated_maps = hash:/etc/postfix/relocated
#smtpd_sender_restrictions = hash:/etc/postfix/access

$transport_maps = hash:/etc/postfix/transport

smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
local_destination_concurrency_limit = 2
default_destination_concurrency_limit = 10
debug_peer_level = 2
debugger_command =
         PATH=/usr/bin:/usr/X11R6/bin

# SMTP Auth Stuff see http://killyridols.net/postfixtlssmtpauth.shtml
smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_sasl_authenticated,
check_relay_domains

#For STARTTLS SMTP
smtpd_tls_cert_file = /etc/postfix/cert.pem
smtpd_tls_key_file = /etc/postfix/privkey.pem
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
tls_daemon_random_source = dev:/dev/urand

5) Test it! telnet localhost 25
If postfix drops the connect, read syslog. Most of my install problems are
with SMTP auth settings, try commenting that out and restarting if postfix
components are dying. Also ensure that your pam files are correct and that
smtpd is not in a chroot environment.

LMTP can speed up stuff, but I didn't do this step, yet....
6) Setup LMTP deliveries (if using cyrus 2.1)

 # addgroup lmtp
 # adduser postfix lmtp
 Fix the socket directory permissions:
        # dpkg-statoverride --force --update --add \
          cyrus lmtp 750 /var/run/cyrus/socket
 Restart Postfix and Cyrus IMAPd
        # /etc/init.d/postfix restart
        # /etc/init.d/cyrus21 restart




--PUREFTPD --
Proftpd doesn't support the ISPMAN LDAP space quotas or denied users so we
run pure-ftpd-ldap.

1) install purftpd-ldap package, setup to run from inetd
  A. edit /etc/apt/sources.list adding:
deb ftp://ftp.debian.org/debian testing main contrib non-free
  B. apt-get update
  C. apt-get install pure-ftpd-ldap libc6 libpam0g libc6-dev locales

2) Edit /etc/pure-ftpd/db/ldap.conf  like so:

LDAPServer localhost
LDAPPort   389
LDAPBaseDN o=ispman
LDAPFilter (&(objectClass=posixAccount)(uid=\L)

3) Edit /etc/inetd.conf like so:
ftp stream tcp nowait root /usr/sbin/tcpd /usr/sbin/pure-ftpd -l
ldap:/etc/pure- ftpd/db/ldap.conf

4) Create a test domain as per our documentation, make sure to add an FTP
user to use below. Be sure to Commit the Session. 

5) Restart inetd and test:
   /etc/init.d/inetd restart
   ftp localhost 
       USER www.domain.com   
       PASS password      

NOTE: Logs to syslog, verify that it is checking LDAP

NOTE: Search for users like so:
  ldapsearch -xv -LLL -b "o=ispman" '(&(objectClass=posixAccount)(uid=joe))'