1 (edited by arneboeses 2018-05-05 20:27:21)

Topic: HAProxy + iredmail + Sogo

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.8 (Apr 20th)
- Linux/BSD distribution name and version: FreebSD 11.1
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? no
====

Hi,

I set up IredMail in a jail. For the installation I used the "LOCAL_ADDRESS='172.16.13.1' bash iRedMail.sh" command.

Everything was installed successfully, except the following warning:
------------------------------------------------------------------------------------------------------------------
WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.sock: No such file or directory.
------------------------------------------------------------------------------------------------------------------

On the host I installed HAProxy with the following configuration:

------------------------------------------------------------------------------------------------------------------
frontend web server
  bind :443 ssl crt /zroot/share/certs/
  use_backend mail if { ssl_fc_sni -i mail.xxx.yyy }

backend mail
  balance roundrobin
  mode http
  server mail 172.16.13.1:443 weight 1 maxconn 1024 check ssl verify none

listen smtp
  bind :25
  mode tcp
  option tcplog
  timeout server 1m
  timeout connect 5s
  server mail mail.xxx.yyy:25 send-proxy check
------------------------------------------------------------------------------------------------------------------

I also added in the main.cf "postscreen_upstream_proxy_protocol = haproxy".

Receiving mails is no problem, but when I'm trying to send a mail, sogo mentioned, that it could not find a smtp server:
----------
May 05 06:10:40 sogod [778]: [ERROR] <0x0x8124ed0c0[SOGoMailer]> Could not connect to the SMTP server 172.16.13.1 on port 25
----------

The only way to be able to send emails via sogo was to change the "SOGoSMTPServer" in the sogo.conf to the dns name mail.xxx.yyy, which was set during the installation to the IP address.

I mean, it is working now and some kind of logical as the jail does not listen on port 25 as the host is already listening on that, but wouldn't it be better to set the dns name instead of the IP address overall during the installation?

Or is there an other trick regarding haproxy, iredmail and sogo?

Best,
Arne

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: HAProxy + iredmail + Sogo

SOGO doesn't support SASL SMTP AUTH, so you need to create a new transport listening on, e.g. 2525 for SOGo, and list all SOGO server addresses in "mynetworks=" for this new transport.

3

Re: HAProxy + iredmail + Sogo

Help us push SOGo team to implement this feature:

- Support for SMTP SASL AUTH and SMTP TLS/SSL
  https://sogo.nu/bugs/view.php?id=31

This is a NINE year old feature request, and SMTP over TLS/SSL is a must-have feature. They just don't care about this.

4

Re: HAProxy + iredmail + Sogo

i have a solution for you.

install inside your iredmail server program called stunnel4

paste it in stunnel.conf:

[local-smtp]
client = yes
accept = 127.0.0.1:10027
connect = 127.0.0.1:587
protocol = smtp
verify = 0
CApath = @sysconfdir/ssl/certs
;CAfile = /etc/ssl/certs/server.ca-bundle
checkHost = * * * *
cert = /root/stunnel.pem
OCSPaia = yes


then post in sogo.conf:
// SMTP server
    SOGoSMTPServer = 127.0.0.1:10027;
    SOGoMailingMechanism = smtp;
    SOGoSMTPAuthenticationType = PLAIN;

it will allow you to connect from sogo with port 587 to postfix.