Migrating to CommuniGate Pro

Some users registered with the server OS may access their mail accounts using legacy mailer applications that read mailbox files directly. Since these mailers bypass Internet protocols, the CommuniGate Pro server has no control over those mailers.

The CommuniGate Pro Server keeps all user accounts and mailboxes inside its "base directory". On a properly configured system direct user access to the base directory is prohibited to ensure that account mailboxes and other Server files stay intact.

When you create a CommuniGate Pro Account for a local user who needs mail access via legacy mailers, select the External INBOX option. In this case, the INBOX Mailbox will not be created inside the CommuniGate Pro base directory. Instead, the INBOX Mailbox location will be taken from the user domain settings.
Usually, you specify /var/mail/* or /var/spool/mail/* - the "standard" location where legacy mailers expect to see user mailboxes.

When the Server accesses these external mailboxes, it uses the OS file-locking mechanism to synchronize its activity with legacy mailers.

Note: legacy mailers were not designed to support simultaneous access to mailboxes. They can destroy data in your mailbox if you open two legacy mailer sessions with the same mailbox and delete messages in one of the sessions. CommuniGate Pro cannot fix this, since these mailers bypass the server, it can only guarantee (using file locks) that legacy mailers do not destroy a mailbox while CommuniGate Pro is working with it.

For more details, see the Mailboxes section.

If your old mail server authenticated clients using the Unix OS account and passwords (the passwd and shadow files), you can simply enable the Use OS Password option for those accounts and the CommuniGate Pro Server will use the OS authentication procedures for them.

Since the OS Passwords are one-way encrypted, they cannot be used for secure SASL authentication methods. The following procedure can be used to allow migrated users to employ the secure SASL methods:

• enable the Use OS Password option either in the Default Account Settings or in the Account Template.
• specify an empty string for the CommuniGate Password in the Account Template.
• import all accounts without the Password field.

Users can connect to the newly created accounts using their old OS Passwords - i.e. the same passwords they used with the legacy mail system. When users try to modify their account passwords, the new passwords will be stored as CommuniGate Passwords. All users that have updated their passwords will be able to use the secure SASL authentication methods.

Sometimes you cannot use this method. For example, you migrate users from a different server, and you do not register them all with the Unix OS on the new server, but you do have the passwd file from the old server. In this case, you may want to enter the Unix-style (crypt-encrypted) passwords as the CommuniGate (internal) Passwords.

To make the CommuniGate Pro server process its internal password string as a U-crpt (crypt-encrypted) or other support encrypted password (see below), store the password in the Account Settings with one-byte binary 002 prefix. If you want to create a user test using the CLI interface, and the Unix (crypt-encrypted) password for that user is AslUzT1JkPsocc, then use the following CLI command:
createaccount "test" {Password="\002AslUzT1JkPsocc";}

If you create users by importing an account list from a text file, place the Unix passwords strings into the UnixPassword column, not into the Password column. In this case, the Loader will automatically add the binary 002 prefix to all password strings. If you create users using the LDAP Provisioning feature, specify the encrypted password as the unixPassword attribute.

Account Settings of the new accounts should specify one of the CommuniGate Pro password encryption methods (clear text or A-crpt). Users will be able to log in using their old Unix/encrypted passwords. When they update their passwords, new CommuniGate Password strings will be stored using the specified CommuniGate Pro password encryption method. All users that have updated their passwords will be able to use the secure SASL authentication methods.

Some servers produced by the Netscape and Software.com companies store user passwords using several encryption methods. When passwords are retrieved from those servers, they have the following form:
{method}eNcoDeD
or
$method$eNcoDeD
where method specifies one of the standard encryption methods, and the eNcoDeD string is an encrypted password (sometime - Base64-encoded).

CommuniGate Pro can use these passwords in the same way it uses the Unix-encrypted passwords, and they should be entered in the same way: you should use the binary 002 prefix in the CLI commands and/or you should place those passwords into the UnixPassword field of the Account Import file.

The following encryption methods are supported:

• {crypt} - the standard Unix crypt method.
• {WM-CRY} - the standard Unix crypt method (same as {crypt}).
• {MD5} - the MD5 digesting method (Base-64 encoded MD5 digest of the password string).
• {SHA} - the SHA1 digesting method (Base-64 encoded SHA1 digest of the password string).
• {NS-MTA-MD5} - the MD5-based method used in the Post.Office servers and old Netscape Messaging servers (the eNcoDeD portion contains 64 hexadecimal digits).
• {SSHA} - the "salted SHA1" digesting method (Base-64 encoded SHA1 digest of the 8-byte salt and the password string, followed with the salt bytes). This method is used in the Sun Directory Server application.
• {LANM} - the "LAN Manager" hash used in Microsoft Windows servers (The eNcoDeD portion contains 32 hexadecimal digits).
• {MSNT} - the "Microsoft NT" hash used in Microsoft Windows servers (The eNcoDeD portion contains 32 hexadecimal digits).
• $1$ - MD5-based password hash used in FreeBSD and some other Unix systems.
• $2a$ - BlowFish-based password hash used in OpenBSD and some other Unix systems.

The following is a sample Import file:

Name UnixPassword Password Type user1  YIdhkjeHDKbYsji Unix-crypt user2  {SHA}Ue4Erbim2TC7CmuukMOBejeytr2= SHA1-digested user3  {MD5}zverMUhsgJUIDjeytr2= MD5-digested user4  {crypt}YIdhkjeHDKbYsji Unix-crypt, same as for the user1 account user5  $1$VlPrB$vNjOAytB3W.j0bkkbaN2Z. BSD-type MD5-encrypted

You can use a CommuniGate Pro CLI script to automatically import all users and their passwords from the OS /etc/passwd file. See the CommuniGate Perl Interface site for a sample script.

If you are migrating from a sendmail-based mail system, you may find the following information useful:

The aliases file

The sendmail aliases file allows the administrator to redirect local mail to one or several addresses. Sendmail uses the term "alias" for too many different things, so you should select the proper CommuniGate Pro feature to implement different types of sendmail "aliases":

• Each account can have one or several aliases. Mail sent to any account alias name is routed to the account itself. If the domain.dom account john.smith has j.smith and smith aliases, mail sent to j.smith@domain.dom and smith@domain.dom addresses is delivered to the john.smith@domain.dom account. When an account is renamed, its aliases automatically start to point to the new name, and when an account is removed, all its aliases are removed, too.
• Domain Forwarder objects allow you to redirect mail sent to a domain address to any other address. The domain.dom forwarder susan.smith can reroute all mail sent to susan.smith@domain.dom address to the susan@otherisp.dom address.
• Domain Group objects allow you to redirect mail sent to some domain address to any set of addresses.
• The Router module allows you to redirect mail sent to a certain address to any other address. The Router Alias Record <*.smith@domain.dom> = Smith@domain.dom will reroute mail sent to john.smith@domain.dom and to susan.smith@domain.dom to the Smith@domain.dom address.
• The Account Rules allow the administrator and/or the users themselves to redirect/forward/mirror all or certain mail to one or several addresses.
• The Server-Wide Rules allow the administrator to redirect/forward/mirror all or certain mail to one or several addresses.
• The shared or Foreign Mailboxes feature allows a user to grant access to a Mailbox to other users; in many cases a shared mailbox is a much better alternative to mail distribution.
• The LIST module provides a very powerful mailing list distribution mechanism.

procmail processing

The Server-Wide, Domain-Wide, and Account-Level Automated Rules allow administrators and users to perform automatic mail processing and filtering using the powerful condition checking and processing operations built into the CommuniGate Pro Server.
For the situations where messages should be processed using an external filter or processor, the Execute Automated Rules operation can be used to start the specified external program as a separate OS task (for example, the Rules can be used to process all or certain incoming messages with the same procmail program).

The Post.Office product stores account names, passwords, and other information in its account database. The special Post.Office Migration Utility can be used to retrieve that information and to store it in a tab-delimited file that can be used with the CommuniGate Pro WebAdmin Account Import function.

The List Migration script allows you to copy mailing lists and their subscriber sets from Post.Office to CommuniGate Pro.

The Netscape (iPlanet) Messaging server stores account names, passwords, and other information in a Directory server "subtree". Use regular LDAP tools to export the Directory subtree into an LDIF file. The special Netscape Migration Script can be used to convert the account information from the LDIF format into a tab-delimited file that can be used with the CommuniGate Pro WebAdmin Account Import function.

The IMail product stores account names, passwords, and other information in its account database. The special IMail Migration Utility can be used to retrieve that information and to store it in a tab-delimited file that can be used with the CommuniGate Pro WebAdmin Account Import function.

If you want to move your users from a CommuniGate for MacOS server, you can build the account list file using the CommuniGate/MacOS extractor utility.

If you want to move your users from a Stalker Internet Mail Server (SIMS), you can build the account list file using the SIMS extractor utility.

The special Exchange Migration Utility allows you to retrieve user lists from an Exchange server and to create those users in CommuniGate Pro Domains. The utility copies all user folder data (mail, calendaring, contacts, etc.) converting data and address formats "on-the-fly".

The utility also extracts the Exchange Global Address Book and converts it into an LDIF file that can be imported into the CommuniGate Pro Directory.

The utility requires an MS Windows workstation to run.

After you have created the accounts on your new CommuniGate Pro Server, you may want to copy mail from all mailboxes on the old server to the accounts on the new server.

The CommuniGate Pro software package includes the MoveAccounts program. This program uses a tab-delimited text file that contains account names and passwords. It can be the same file you have used to Import Accounts to a CommuniGate Pro domain.

The program scans the file and uses either the MovePOPMail or the MoveIMAPMail program to move messages for each account. These programs should be located in your current directory.

MoveAccounts [--POP | --IMAP] file sourceServer targetServer [suppl_parameters]

--POP, --IMAP

Parameters that specify whether MovePOPMail or MoveIMAPMail program should be used. If none is specified, the MovePOPMail program is used.

file

The name of a tab-delimited file that contains account names and passwords.

sourceServer

The IP address of the old (source) server (POP or IMAP); can include the port number.

targetServer

The IP address of the new (target) server (SMTP or IMAP); can include the port number.

suppl_parameters

Optional parameters (such as --verbose, --delete, --notimeout, --list search, etc.) passed to the MovePOPMail or MoveIMAPMail program.

The first line of the file should contain the data field names. The fields with names Name and Password must be present.

If the field NewName exists, it is used as the SMTPrecipient parameter when the MovePOPMail program is started, or as the newName parameter for the MoveIMAPMail program. Otherwise the same Name field data is used.

If the --IMAP parameter is specified, the program checks if the NewPassword field exists. If it does, the data in that field is passed as the newPassword parameter to the MoveIMAPMail program. Otherwise, the same Password field data is used.

All fields with other names are ignored.

The following is a sample AccountList file:

Name Limit Password john 10K j27ss#45 jim 120K dud-ee george 31M mia#hj!

If you cannot obtain the clear-text passwords for all accounts you want to copy, and the old server is using the Unix /etc/passwd or /etc/shadow file, follow these steps:

• Find the OS file that contains the encrypted user passwords: /etc/passwd, /etc/shadow, or /etc/master.passwd (see your OS documentation). We will refer to that file as /etc/shadow.
• Create a backup copy of the /etc/shadow file.
• Find the /etc/shadow record that contains information for your own account or any other account you know the clear-text password for. Let us say that this known unencrypted OS account password is mypassword, and the encrypted password you see in the /etc/shadow account record is FU3jjF/gkJJdA.
• Edit the /etc/shadow file so all account records will contain FU3jjF/gkJJdA in their encrypted password fields.
• Open the CommuniGate Pro Default Account Settings page for the domain you are migrating. Enable the Use OS Passwords option and check that the OS UserName option is set to *.
• Create the AccountList file that contains the account names in the Name field, and the string mypassword in the Password field.
• Copy all account mailboxes from the old server to the new server using the MoveAccounts command. The command will successfully log into both servers, since all accounts on both servers accept the string mypassword as the account password.
• Restore the /etc/shadow from the backup copy.
• Disable the Use OS Password setting in the CommuniGate Pro Default Account Settings, if you do not want to use OS Passwords for your CommuniGate Pro Accounts.

Use this alternative migration method when the password switching method explained above cannot be used, and/or the user names and passwords cannot be retrieved from the old server.

The method is based on the External Authentication feature of the CommuniGate Pro server.

Download, install, and tailor the migration script, and configure CommuniGate Pro to use this script as the CommuniGate Pro External Authentication program.

Create the target CommuniGate Pro Domain, and in the Domain settings enable the Consult External Authenticator option. Disable the Use CommuniGate Password option and enable the Use External Password option in the Account Template.

When a user attempts to connect to a non-existent Account, or when CommuniGate Pro receives a message for non-existent Account, the External Authentication script is called. The script connects to the old server using the SMTP protocol and checks if the account with the same name (same address) exists on the old server. If the old server does not reject the address, the script creates the Account with this name in the CommuniGate Pro Domain. Then the CommuniGate Pro Server delivers the message to this newly created Account.

When a user connects to the CommuniGate Pro Server, the user mailer sends the user name and the user password in the plain text form. Because the CommuniGate Pro Account has the Use CommuniGate Password option disabled, and the Use External Password option enabled, the External Authentication script is called. The script connects to the old server using the POP or IMAP protocol and checks if it can log into the old server with the provided user credentials.

If the old server accepts the specified password:

• the script uses the CommuniGate Pro CLI:
  • to set the specified password as the CommuniGate Password for this Account,
  • to switch off the Use External Password option for this Account,
  • to switch on the Use CommuniGate Password option for this Account.
• the script starts the MoveIMAPMail or MovePOPMail programs to copy the account mailboxes from the old server to the CommuniGate Pro server, or saves the name/password pairs into a text file which you can later use with the MoveAccounts program (this is a configurable option).

After the first successful login, the correct password will be set as the new CommuniGate Password, and all Account mail will be copied from the old server.

After all old server users have successfully connected to the CommuniGate Pro server at least once, all their Accounts will be created and have the correct CommuniGate Passwords set. Then you can disable the External Authentication script and retire the old server.

Very often it is essential to switch to the new server without any interruption in the services you provide.

If you install the new CommuniGate Pro server on the same system as the old mail server, you should:

• switch CommuniGate Pro SMTP receiving to port 26, so it will not interfere with your old server smtp activity.
• switch CommuniGate Pro POP service to port 111, and IMAP service to port 144, so they will not interfere with your old server pop/imap activity.
• Configure CommuniGate Pro and create domain aliases and full featured Secondary Domains.
• Create some test accounts in the main and secondary domains and check that you can log into those accounts using WebUser Interface.
• Check that you can send mail from those accounts using the WebUser Interface: mail to other test accounts in the created domains and mail to other servers should be delivered correctly.
• If you have a POP or IMAP client that allows you to specify a non-standard port number, check that you can log into the test accounts on the POP port 111 and IMAP port 144.
• Create tab-delimited file(s) with names, passwords, and other attributes of your existing accounts and use the Account Import feature to create all accounts on your new server.

All this can be done while your old server is still active.

Now, you should stop your old server activity by either changing its port numbers to non-standard values, or by disconnecting it from the external network.

Use the AccountMove program to copy all messages from your old server to CommuniGate Pro.

When all messages are copied, change the CommuniGate Pro SMTP port number back to 25, POP port number - to 110, and IMAP port number to 143. Now CommuniGate Pro will operate as your mail server, without any interruption in the services you provide.

You may want to keep the old server running for several hours - in case its queue contained some delayed outgoing messages. Just check that the old server does not try to use the standard ports.

If you create several Secondary domains in CommuniGate Pro, you may want to move accounts from your old server(s) to a Secondary CommuniGate Pro domain, not to its Main Domain.

In this case, you should add the NewName field to your account list file, and copy all names into that column, adding the @domainname string to each name.

If you use the IMAP protocol to move messages between the servers, you may use a simpler method:

• If the target domain has an IP address assigned to that domain, use that address in the mail copying programs: all non-qualified names provided on connections established with that address are interpreted as names in that domain. See the Access section for the details.
• If the target domain does not have an assigned IP address, temporarily assign the IP address of the main domain to that secondary domain. Move the messages, and remove the IP address from the list of addresses assigned to that domain.