Linux mail server, Blackberry Enterprise Server, GMV Atlas - few questions

[3s-gtech]

Hi all,

One of our staff has got a Blackberry, thinking that it'd work 'out of the box' with our internal email system. It can browse the webmail interface fine, but of course it can't receive emails through the push email system on the unit.

 

I looked into setting up BES for hime (as it's free for 0-20 users). Of course, this requires an Exchange server, which we don't have. However, I found GMV Atlas which interfaces BES and Linux mail servers (we use Exim in a custom LEA provided configuration).

 

Unfortunately, Atlas does not work where IMAP uses SSL/TLS, it wants to connect on port 143 which is disabled.

 

I don't really want to give up on this one until I've exhausted my patience, as BES could be very handy for SLT in the future. Not massively keen on going for Exchange purely due to costs, but it's obviously the primary solution. Can anyone suggest a way of getting this to work? Either the required setting change on the email server (Slackware) to enable it to talk on 143 (not too worried about plaintext, as there's no off site mail access other than webmail, and all staff are set up with SSL anyway), or perhaps auto-forwarding the emails on to another server which I can connect to.

 

I'm not hugely familiar with the configuration for IMAP/Exim so I'm not sure if it's just a config file change, or a recompile job

 

Thanks!

[dhicks]

One of our staff has got a Blackberry, thinking that it'd work 'out of the box' with our internal email system.

 

Can Blackberry pick up email from POP3 or IMAP - could you enable one of those protocols on your email server?

[3s-gtech]

It can pick up from IMAP through Atlas - but only through the (not enabled) port 143. It can only pick up POP3 through the web browser, and our county firewall doesn't allow pop3 and imap connections I believe.

[dhicks]

It can pick up from IMAP through Atlas - but only through the (not enabled) port 143. It can only pick up POP3 through the web browser, and our county firewall doesn't allow pop3 and imap connections I believe.

 

Ah, so you can only have connections from outside through port 80 and 443? Can Blackberry's service be set to access POP3 / IMAP throuh non-default ports - could you get a second IP address from your county services and set up an IMAP server on port 80? Edit: no, you've just told me it can't... drat.

 

Could you use an external server for Blackberry's service to connect to - have the external server pick up email from your internal system and make it available via IMAP?

[sukh]

1. Not sure what MS agreement you're on and what your budget is, but I'd go for the Exchange option, not only will you achieve you goal but the extra benefits you get will be a advantage over what you're using.

 

Sukh

[edutech4schools]

Also the Google Apps for Education should do this and comes with Blackberry admin control.

[3s-gtech]

Could you use an external server for Blackberry's service to connect to - have the external server pick up email from your internal system and make it available via IMAP?

 

Yup - that's another possibility - use Google Mail (which the staff already use for calendars) with the BES app. However, that'll need us to move to googlemail for all our email accounts for it to work properly I think. Must be an easier way?

[edutech4schools]

Don't know if google still allow you to use their mail servers as a grab and push service but I had that set up a few years back with the standard single user mail system. My ddns account would not let me send mail with standard ports from home mail server so I used google to fetch the mail and then grabbed the mail back out from google and into my other email server.

[dhicks]

Don't know if google still allow you to use their mail servers as a grab and push service

 

They used to let you have a "catch all" account, so any email address sent to @Your.domain that didn't go to a valid username would simply be dumped in the catch-all account. You can then use fetchmail or similar server-side to place your emails whereever you like - I use fetchmail at home to get emails from my ISP's account, place them in an IMAP server and read them from there with SquirrelMail as my web-based email client.

[dhicks]

I'd go for the Exchange option, not only will you achieve you goal but the extra benefits you get will be a advantage over what you're using.

 

I've just upgraded our system from Exchange 2003 to Exchange 2010, and I still don't get what the point of it is. Email is simple, you just install an email server, same as you have for the past 30 (40?) years or so, and there must be a bunch of decent third-party web-based calandaring applications about. Installation, trouble-shooting and management of an Exchange server doesn't seem to be any different in difficulty level from any other email server - my home server setup took around a day for me to figure out all the bits needed, the school one has taken longer but there's been more people to find issues. If you're going to pay for an email server it should be really, really easy to set up and use - I can't see what we're paying for with Exchange that we can't do for free with something else.

[SYNACK]

BES is horrible and I would rather set myself on fire than deal with it again. Avoid it if it is at all possible to. Set them up over IMAP and tell them to get a real device like a Nokia E series/Windows Phone 7/Android/iPhone if they want a decent experience.

[GrumbleDook]

A *BIG* warning about using random external servers to pick up emails from your in-house server to allow access to personal devices ... you then have *NO* control over the email, the contents and where it may go. You may end up in breach of DPA as well as introducing a risk to the school of misuse. As much as people will say that email is public, that is not always the case. User to User emails (eg Head to Bursar) is in house so when that spreadsheet of personnel data is being passed back and forward this is fine and secure ... but when it is pulled to an external box to allow it to be collected then you have no control.

[3s-gtech]

Noted GD, I did think of this. However, this will happen using a Blackberry - with email totally inhouse, the BES still sends the data to RIM's servers which in turn send it to the device. There'll be an element of external connection here.

 

I have spoke to our LEA resident Linux guru. He has helped me install a second IMAP server on the email system which processes mail to port 143, so not touching the existing one on 993. Atlas can connect to this (though I'm not sure if imap idle is working). I'll report back on it.

 

I've not used BES yet to know how bad it is. There is a new version out - perhaps that's helped somewhat?

[SYNACK]

I've not used BES yet to know how bad it is. There is a new version out - perhaps that's helped somewhat?

 

I have used both old and new verions, the newer versions have just turned into a giant memory hogging soup of random components all running java, spewing unhelpful logs into massive text files loosly linked to the modules. It can also quite happily sit there reporting no errors and not working at all. Their support is rubbish and their forums are generally out of date, the knowledgebase is practically unsearchable and this is even before you get into the custo DB modifications it needs just to work. They may as well not even have an installer given how much you need to do manually. Their systems support is at least 6 months behind software versions (Example Exchange 2010 SP1 took 6 months to be suported).

 

I have had to install and support one BES server through various versions and OSs, that idiot software is soul destroying, I was not kidding about the fire bit above. It is that bad.

Edited May 11, 2011 by SYNACK

[sukh]

@david

 

There's a number of benefits, dont know where to start. A simple one, redundacny. 2010 offer redundacny at the database level and hardware level. I've seen a few posts here where the school email server might go down. If you're school doesn't mind then fair enough, you can then use any free email system. WIth 2010 you can have multiple copies of your database across multiple servers, across multiple sites. Should a server failure occur, database failure or even a site failure, your email is still availalble.

 

There's a big performance improvement from 2003, in terms on IOPS, which leads to lower RPC latency and a better user experience.

 

You have transport rules which can be implemented, for e.g preventing staff of users sending out confidential information via email to their personal email accounts.

 

Sukh

[sukh]

@SYNACK

 

I agree/disagree. I've used BES and one thing I can relate to is the logs. They are rubbish. However, it does what it's supposed to. Works nicely and like with every product there are good/bad points.

 

Support I've had has been extremly good. Not sure on your experience. When I call RIM, I get an anser straight away.

 

Another option to use Exch is you can use EAS (active-synch) which is covered by your CAL. There's a pluggin for so that BB can use it too. No need for any addtional infrastructure.

 

S

[dhicks]

A *BIG* warning about using random external servers to pick up emails from your in-house server to allow access to personal devices ... you then have *NO* control over the email, the contents and where it may go.

 

I'd assume the external server is your own, and was using a secure method to obtain emails from the one inside the firewall. You're right, though, it would probably be a mistake to export your internal email to Google's servers - your email should stay under your control.

 

Equally, it would be a mistake to assume that anything behind your firewall is safe and not properly secure servers - many schools have little protection against people plugging in whatever devices they can sneak in and running port scanners or similar.

[SYNACK]

@SYNACK

 

I agree/disagree. I've used BES and one thing I can relate to is the logs. They are rubbish. However, it does what it's supposed to. Works nicely and like with every product there are good/bad points.

 

Support I've had has been extremly good. Not sure on your experience. When I call RIM, I get an anser straight away.

 

Another option to use Exch is you can use EAS (active-synch) which is covered by your CAL. There's a pluggin for so that BB can use it too. No need for any addtional infrastructure.

 

S

 

Thanks @sukh Good to hear that it can work, I have had my fill of BES though and would need to be medicated heavily to even consider going near it again. It is possibly one of the worst things that I have ever dealt with in IT and I would put it right up there with SBS 2003 on the list of worst products in existance. As to support I don't think that they even know NZ exists, they can't find a 100 year old street on their address verification system. I can only hope that other solutions continue to crush it out of existance at the current rate so that I never have the misfortune of encountering it again.

[dhicks]

2010 offer redundacny at the database level and hardware level.

 

Simple mirroring failover (your mail server hardware conks out, another takes over) should be handled by your virtualisation solution. For larger installations, I imagine mySQL has a mirroring / load balancing solution. I seem to remember my home email server being file system based, so I guess that would just use a distributed file system for storage.

 

There's a big performance improvement from 2003, in terms on IOPS

 

Sorry, meant comparing Exchange (any version) with other email servers.

 

You have transport rules which can be implemented

 

Would Sendmail or similar use some kind of post-processing script or regular expression to do the same thing?

[sukh]

+1 - When you using BES, it's secure all the way up to your BES router, from here, the next hop os the BES NOC, which again is secure. Then to your device.

 

Also, you do have control, what control dont you have, if you dont, then I'd choose the appropiate 3rd party.

Sukh

[sukh]

@david

 

If we're talking just about Exchange then we have HA here, if we bring virtualisation into this, then we're looking at something completly different.

 

If you have virtualisation deployed then yes, this can work, however if you dont then this brings in extra costs. Also, normal virtualisation (depends on what vendor you are using),you have to buy additional licenses to activate or use this feature. Even then, you will need some sort of replication between the two hosts, if using a SAN, then you will need further software, and possibly a license to use replications.

 

Even comparing Exch with other servers, I have just mentioed a few things here. The amount of users on an Exchange platform has to be a reason why it's chosen. Even live@edu which I see many schools are using runs off Exchange.

 

I'm not too sure how Send mail, cant comment. But you can use regular expressions with Exch.

[SYNACK]

@dhicks - You can do most things that you can do with exchange using free software, you just need to use a lot of it. Exchange is all in one nice bundle proven and designed to work right together under one unified system with one config and one standard. To accomplish even part of this functionality you would need to couple sendmail with a backend DB, this with the ability to be block mirrored to another server and to another drive on the same server. You would need calanders from another bit of software, contacts and tasks storage along with a system to process mailbox rules at the server all linked back into the databases. You would also need a system to seurely mirror just logon details and password hashes to and external database that could run on a different system in a DMZ. This is not even touching on the autocomplete functions, the very competent webmail which is a massive improvement from 2003. You would also need to look to add in a whole Astrix phone system backend to handle voice messages, voice recognition to transcribe voicemail and text to speech to read them out. Add in Activesync support which you would need to liscence and you have a massive pile of free software tacked together in all sorts of ways making it unsuportable by anyone but its creator and probably a nightmare to troubleshoot.

 

There are solutions that do provide a good subset of these features but in general even though they are based on free software some of the nice aditional features like the far superior (in comparision to IMAP and POP3) Activsync protocol are only in the pay for versions.

[3s-gtech]

Still using Atlas and IMAP, the software is looking more promising - though it's struggling a bit with the idle capability (which is listed as a capability of IMAP on that port). If I can get past this, I may get somewhere! Edited May 11, 2011 by 3s-gtech

[3s-gtech]

Seems that idle isn't working properly - it can enter the idle state using telnet, but doesn't receive the done call when a new message arrives. Not sure why yet.

[luis1979]

Seems that idle isn't working properly - it can enter the idle state using telnet, but doesn't receive the done call when a new message arrives. Not sure why yet.

 

One of the steps of the Atlas installer can help you because it checks the configuration of SMTP, IMAP and Administrator data account according to the data inserted during the setup process (this step is named Registration and verification), there you can see the checklist results for the IMAP, SMTP and IDLE.

 

There are some logs that may be useful under C:\Program Files\GMV\Atlas\Logs\aaaammdd_Atlas\YOURMACHINE_REVXXXX_AtlasSetup_PIDXXXX_main.log, there is also a forum for technical questions in Atlas GMV web site