Student Email Accounts

[edsa]

Hi

 

We have decided that instead of students using webmail accounts such as hotmail and yahoo mail, that we should standardise the e-mail service that students use. This is mainly for security and ease of management.

 

I have been trying to convince the Head that we need an Exchange solution in our school, because at the moment we are using the county email provision as our staff internal email system, which is a nightmare to manage for us.

 

Would it be possible to implement a solution internally that would provide an internal staff system and a system for students? If so how could we configure say Microsoft Outlook on the curriculum PCs to allow any user to open their individual mailboxes?

 

cheers for any info or advice

 

Ed

[CyberNerd]

Exchange is a complete waste of money if you compare it head to head with OpenSource Zimbra.

 

Zimbra offers Open Source email server software and shared calendar for Linux and the Mac

[edsa]

Exchange is a complete waste of money if you compare it head to head with OpenSource Zimbra.

 

Zimbra offers Open Source email server software and shared calendar for Linux and the Mac

 

This looks quite good! I wiil look further into it. The hosted option seems quite good as long as it lets you create and manage users in bulk.

[speckled]

Give this a look, we use it for exactly what you want to do and its free!

http://www.mailenable.com/:)

[Geoff]

This looks quite good! I wiil look further into it. The hosted option seems quite good as long as it lets you create and manage users in bulk.

 

I don't know about the hosted version. But I can create users in bulk from the command line on our Zimbra box with a CSV file and a few awk scripts.

[Stuart_C]

Personall using MDaemon here.

 

Easy to set up plugs into Outlook if you pay for the connector. Nice web interface (not perfect but good enough) for all accounts. Links in to AD so account creation is easy and it doesn't attempt to do terrable things to your AD Schema.

 

Been using it for a number of years now and I've had nothing particularly massive to grumble about.

[CyberNerd]

I don't know about the hosted version. But I can create users in bulk from the command line on our Zimbra box with a CSV file and a few awk scripts.

 

eeek - sounds complicated.

 

heres a python script I cooked up to automatically create the accounts from Active Directory

 

#!/usr/bin/python

# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; GPLv3
#      
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#              
# To obtain a copy of the GNU General Public License, write to the Free Software Foundation,
# Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
#
#--------------------------------------------------------------------------------------------------
# Notes:
# This script automatically creates zimbra accounts from active directory, the actrive directory account must have
# the employeeType=STUDENT attributed set. If accounts are in the 'banned' active directory group then the
# account will automatically be locked when the script is run, and unlocked if they are no longer in the AD 
# banned group                       
#--------------------------------------------------------------------------------------------------

# Variables can be changed here:
banned =  'CN=Banned,CN=Users,DC=college,DC=internal'
# an OU for banned users
scope   = 'ou=OU,dc=college,dc=internal'
#the search scope
domain = "domain.college.internal" # "example.com"
ldapserver="server1"
#ldap server
port="389" 
#ldap port (389 default)
emaildomain="zimbra.school.sch.uk"
#the email domain
ldapbinddomain="DOMAIN"
#the domain of the ldap bind account
ldapbind="ldapusername"
#the account name of the account to bind to ldap
ldappassword="password"
#the ldap password
pathtozmprov="/opt/zimbra/bin/zmprov"
#--------------------------------------------------------------------------------------------------
import ldap, string, os, time, sys

#output the list of all accounts from zmprov gaa (get all accounts)
f = os.popen(pathtozmprov +' gaa')
zmprovgaa= []
zmprovgaa = f.readlines()
          
l=ldap.initialize("ldap://"+ldapserver+"."+domain+":"+port) 
l.simple_bind_s(ldapbinddomain+"\\"+ldapbind,ldappassword) #bind to the ldap server using name/password 

try:
   res = l.search_s(scope, 
   ldap.SCOPE_SUBTREE, "(&(ObjectCategory=user) (userAccountControl=512)(employeeType=STUDENT))", ['sAMAccountName','givenName','sn','memberOf'])
#userAccountControl  512 = normal , 514 = disabled account
   for (dn, vals) in res:
     accountname = vals['sAMAccountName'][0].lower()
     try:
       sirname = vals['sn'][0].lower()
     except: 
       sirname = vals['sAMAccountName'][0].lower()
     try:
       givenname = vals['givenName'][0]          
     except:
       givenname = vals['sAMAccountName'][0].lower()
     try:
       groups = vals['memberOf']
     except:
       groups = 'none'
     initial = givenname[:1].upper()
     sirname = sirname.replace(' ', '')
     sirname = sirname.replace('\'', '')
     sirname = sirname.replace('-', '')
     sirname = sirname.capitalize()
     name = initial + "." + sirname
     accountname = accountname + "@" + emaildomain
     password = "  \'\' "
     sys.stdout.flush()
     
     # if the account doesn't exist in the output of zmprov gaa create the account
     if accountname +"\n" not in zmprovgaa:
       
       print  accountname," exists in active directory but not in zimbra, the  account is being created\n"
       time.sleep(1)
       os.system(pathtozmprov +' ca %s %s displayName %s' % (accountname,password,name))  


     # if the account is in the group 'banned' check to see if account already locked
     if banned in groups:
       zmprovga = os.popen(pathtozmprov + ' ga %s' % (accountname))
       ga= []
       ga = zmprovga.readlines()
       locked = "zimbraAccountStatus: locked\n"
       if locked not in ga: #if account not locked then lock it
         print accountname, " has been BANNED from the internet. The email account has been locked "
         os.system(pathtozmprov + ' ma %s zimbraAccountStatus locked' % (accountname))
         time.sleep(1)
       else:
         print accountname, " has a locked email account because they are in the 'banned' group"
      
      #set any accounts to 'active' if they are not in the banned group and the account is currently locked
     else:
       zmprovga = os.popen(pathtozmprov + ' ga %s' % (accountname))
       ga= []
       ga = zmprovga.readlines()
       locked = "zimbraAccountStatus: locked\n"
       if locked in ga:
         os.system(pathtozmprov + ' ma %s zimbraAccountStatus active' % (accountname))
         time.sleep(1)
         print accountname, " is no longer in the 'banned' group, therefore the account has been activated"                            

          
except ldap.LDAPError, error_message:
 print error_message          

l.unbind_s() 

[edsa]

Some good options there guys cheers

 

I take it you are not fans of Microsoft Exchange then

[CyberNerd]

I take it you are not fans of Microsoft Exchange then

 

For me it isn't a case of not being a fan - it's just offers less and works out much more expensive when you consider the lock-in, extras such as filtering etc. We've been running zimbra for 2yrs and haven't looked back.

[zag]

Using exchange here, runs like a dream and is fully AD aware.

 

Even better is to integrate it with sharepoint.

 

Backupexec is one click to restore the entire system as well Always nice to know!

Edited November 27, 2008 by zag

[Domino]

Exchange here as well - not hit any limitations with what we want it to do.

 

The 2007 OWA and outlook anywhere are fantastic too

[bossman]

Zimbra here:

Excellent staff really like it with all it's features, Headteacher loves it even as he is an outlook fan he say's Zimbra is like a breath of fresh air and it's free wahoooooooo!!!!

:) :)

[edsa]

Exchange here as well - not hit any limitations with what we want it to do.

 

The 2007 OWA and outlook anywhere are fantastic too

 

Do students access their mailboxes through OWA in school, or can they use Outlook?

[Domino]

Currently not in a school.

 

But OWA but would be my recommendation for students.

 

Outlooks to prone to issues to be 'student-proofed'

 

and the new web interface is almost fully featured anyway

[Ric_]

I take it you are not fans of Microsoft Exchange then

 

Another convert to OpenSource Zimbra here I'm afraid.

 

Exchange is very good, it integrates seamlessly with AD, has OWA and just works. The problems only arise when you realise that you want to give external access to it and you suddenly need to spend thousands on licensing!

 

Zimbra has all the features we needed, I'm perfectly happy running Linux and it dodged a massive licensing nightmare. Using the open source version means that I can always run the latest and greatest version too without upgrade costs!

[edsa]

Another convert to OpenSource Zimbra here I'm afraid.

 

Exchange is very good, it integrates seamlessly with AD, has OWA and just works. The problems only arise when you realise that you want to give external access to it and you suddenly need to spend thousands on licensing!

 

Zimbra has all the features we needed, I'm perfectly happy running Linux and it dodged a massive licensing nightmare. Using the open source version means that I can always run the latest and greatest version too without upgrade costs!

 

Yes I agree with the licensing issues Ric, it could turn into a nightmare. Do you host Zimbra internally?

[Ric_]

Do you host Zimbra internally?

 

Yes.

 

Currently it's running on an old HP server (seriously over specced - 4x Xeon, 4GB RAM, plugged into my AX100 SAN) that I got cheap from 1st Technologies. The only thing you need to do is publish port 443 and 25 to the web.

[edsa]

We don't host any web services internally. If I was to install this would I have to point the Zimbra box to externally hosted DNS servers for access from outside the school?

[bossman]

@Ric:

you forgot to mention some of the great features, the bad word filter thanks to Cybernerd, antispam, antivirus plus instant messaging to name but a few.

Just brilliant. :) :D:D:D:D

[Ric_]

@Ric:

you forgot to mention some of the great features, the bad word filter thanks to Cybernerd, antispam, antivirus plus instant messaging to name but a few.

Just brilliant. :) :D:D:D:D

 

That's because I am lazy... and I have come to take all the features for granted since starting to use Zimbra.

 

My technician and I find the IM feature particularly handy... he wanders off to do something and then IMs me if he gets stuck!

[kesomir]

We don't host any web services internally. If I was to install this would I have to point the Zimbra box to externally hosted DNS servers for access from outside the school?

 

Since the server is behind a firewall, what we do is point external dns mx records to our external ip, then forward the relevant ports to the mail server and use split-dns so zimbra can resolve.

 

Split DNS - Zimbra :: Wiki

[kennysarmy]

another vote for Mdaemon...

[rob101]

To the guys who use Zimbra, do you have the ability to create key words and if the email system picks them up for it to not send them to intended person but to another email box set up.

 

why i ask is we had a kid send a nasty email to the entire school, even the governors, and im looking into ways to stop the email going any were and only to my inbox, now i have found out the exchange will do it, but the entire license thing is hugely complex and not like Microsoft at all, I'm just wondering if this other bit of kit can do it?

 

Cheers

[webman]

To the guys who use Zimbra, do you have the ability to create key words and if the email system picks them up for it to not send them to intended person but to another email box set up.

 

Yes, it does it with this modification.

[Dos_Box]

Exchange 2007 here, with the added benefit that users can access their user areas via OWA 2007 too