Graphic with differences between full backup and incremental backup

It is also possible to make these *backups* to a remote host, since they are
included in the subscription services provided by Zentyal. If your Zentyal server
has **Professional** or **Enterprise Subscription**, part of the commercial offering
of Zentyal, you have the option to remotely backup both your server configuration
and the data kept on your server. Likewise, the free Basic Subscription [#]_ , designed
for testing environments, also offers one remote configuration backup. With any of these
three options, in case a server failure or human error causes a problem with the server
configuration, you can always recover it quickly from the Zentyal repositories in Zentyal Cloud.

Zentyal offers a configuration *backup* service, to ensure the recovery
of a server when a disaster occurs, for example a hard disk failure
or a human error while managing configurations.

 service, to ensure the recovery

.. figure:: images/intro/zentyal-backup-menu.png
   :align: center

   Configuration backup screen

*Backups* can be made locally, saving them on the local hard drive of
the Zentyal host. After this, it is recommended to save them to an external
physical system, so if the machine suffers a failure, you still have access to this
data.

 can be made locally, saving them on the local hard drive of
data.

To access the backup options, go to :menuselection:`System
--> Import/Export configuration`. You can not backup if there are unsaved changes in
the configuration.

. You can not backup if there are unsaved changes in

.. figure:: images/backup/ebox_backup.png
   :scale: 60
   :alt: Configuring the backup

   Configuring the backup

Once you have entered the :guilabel:`Name` for the backup, chosen the
type of backup (incremental or full) and clicked on :guilabel:`Backup`,
you will see a window which will show the progress of the different modules
until the message **Backup successfully completed** is displayed

 for the backup, chosen the
type of backup (incremental or full) and clicked on 

,
until the message 

Afterwards, if you return to the former window, you can see in the
bottom of the page a :guilabel:`Backups list`. Using this list you
can restore, download to a client disk or delete any of the saved
copies. Additionally, you will have data about the creation date and size.

bottom of the page a 

. Using this list you

In the :guilabel:`Restore backup from a file` section you can send a security
copy file that you have previously created, for example, associated with a
former Zentyal server installation in another host and restore it using
:guilabel:`Restore`. You will be asked for confirmation; simply remember to be careful,
as the current configuration will be completely overwritten. The restoration
process is similar to the copy; after showing the progress, the user will be notified
with a success message if there is no error.

 section you can send a security

. You will be asked for confirmation; simply remember to be careful,

There are two CLI tools available that will also allow you to save and restore the
configuration. You can find them in :file:`/usr/share/zentyal`; they are called
:command:`make-backup` and :command:`restore-backup`.

configuration. You can find them in 

:command:`make-backup` allows you to make configuration backups, among
the options you can select the backup you want to execute,
and also the configuration report that can help the developers to
diagnose a failure with the extra information.  Note that in
this mode, the user's passwords are replaced for increased
security. The configuration report can also be generated
from :menuselection:`System --> Import/Export configuration`, button
:guilabel:`Generate and Download report file` in the *web* interface.

 allows you to make configuration backups, among
from 

You can see all the options of the program with the parameter `--help`.

:command:`restore-backup` allows you to restore configuration backup
files. It also has an option to extract information from the
file. Another interesting option is the possibility of making
partial restorations, only of the selected modules. This is the
typical case when you want to restore part of the configuration from
an old copy. It is also useful when the restoration process has
failed for any reason. You have to take special care with the
dependencies between modules. For example, if you restore a copy of
the firewall module which depends on a configuration of the
objects and services module, you have to restore these first. Even then, you
have the option of ignoring dependencies, which can be useful if
used with care.

 allows you to restore configuration backup

If you want to see all the options of this program use
the parameter `--help`.

the parameter 

You can access the data backup menu going to
:menuselection:`System --> Backup`

First of all, you have to decide whether you are going to store your backups locally or
remotely. In the latter case, you need to specify which protocol is going to be
used to connect the remote server.

.. figure:: images/backup/ebox_ebackup_01.png
   :scale: 80
   :alt: Configuration

   Data backup configuration

:guilabel:`Method`:
The different supported methods are *FTP*, *Rsync*, *SCP*, *Zentyal
Cloud*, *File system*. Take into account that depending
on the method you choose, you will have to provide more or less
information. All the methods except *File system* use remote
servers. If you select *FTP*, *Rsync* or *SCP*, you will have to
enter the associated authorisation to connect with the server and
the remote server's address.

**Zentyal Cloud** is the **Zentyal Disaster Recovery Service** [#]_
that guarantees that your most critical data is backed up,
secured, monitored and recovered quickly and easily in case of a
disaster. In order to use this service, you must have a
**Professional** or **Enterprise Subscription**.

.. [#] https://store.zentyal.com/other/disaster-recovery.html

. Take into account that depending
information. All the methods except 

, you will have to

When using *SCP*, you have to run `sudo ssh
user@server` and accept the server fingerprint in order
to add to the list of servers known by SSH. If you do not perform this
operation, the backup will not work, because the connection
with the server will fail.

 and accept the server fingerprint in order

For *remote methods* you have to enter the remote server name or its
IP address with the following format:
:samp:`{other.host}:{port}/{existing_directory}` In case you are using
*File system*, you only need the local directory path.

 you have to enter the remote server name or its

:guilabel:`User`:
User name to authenticate in the remote host.

:guilabel:`Password`:
Password to authenticate in the remote host.

:guilabel:`Encryption`:
You can cypher the data in the backup using a symmetric key that will
be entered in the form, or you can use a GPG key already created to
perform asymmetric cyphering in your data. The GPG keyring is extracted
from `ebox` user.

from 

:guilabel:`Full Backup Frequency`
This parameter is used to determine the frequency for complete
backups to be performed. The values are: *Only the first time*,
*Daily*, *Weekly*, *Twice a month* and *Monthly*. If *Weekly*,
*Twice a month* or *Monthly* is selected, you will see a selection option
to choose the exact day of the week or month to perform the backup.

If *Only the first time* is selected, then it is mandatory to set a
frequency for incremental backups.

backups to be performed. The values are: 

 is selected, you will see a selection option

 is selected, then it is mandatory to set a

:guilabel:`Incremental Backup Frequency`
This value sets the frequency of the incremental copy or disables it.

If the incremental copy is enabled, you can choose a *Daily* or
*Weekly* frequency. In the latter case, you have to decide the day of
the week; either way you have to take into account the chosen
frequency which has to be greater than the full backup.

The days that you have scheduled a full backup, Zentyal will not perform
any scheduled incremental copy.

 frequency. In the latter case, you have to decide the day of

:guilabel:`Backup process starts at`
This field is used to set the time a backup copy is started,
for both the full and the incremental backup. It is a good idea to set it to
a time frame where no other activities are being performed in the
network, because it can consume a lot of upstream bandwidth.

:guilabel:`Keep previous full copies`
This value is used to limit the total number of copies that can be stored.
You can limit by number or by age.

If you limit by number, only the set number of copies, plus the last
complete copy will be stored. If you limit by age, you will only
save full copies that are newer than the indicated period.

When a full copy is deleted, all the incremental copies associated
with it are also deleted.

From the :guilabel:`Includes and Excludes` tab you can configure the
specific data you want to backup.

The default configuration will perform a copy of all the file system
except the files and directories explicitly excluded. In case you are using
the method *File system*, the destination directory and all its contents
will be excluded as well.

the method 

, the destination directory and all its contents

You can set path exclusions and exclusions that match a regular expression.
Exclusions by regular expression will exclude any path which matches the
expression. Any excluded directory will also exclude all its contents.

In order to further refine the backup contents, you can also define
*inclusions*, when the path matches an inclusion before it
matches with an exclusion, it will be included in the backup.

, when the path matches an inclusion before it

The order of application of inclusions and exclusions can be changed
using the arrow icons.

You can exclude files by their extension using a regular expression
exclusion. For example, if you do not want the *AVI* files to be in the
backup, you can choose *Exclude by regular expression* and add `\.avi$`.

exclusion. For example, if you do not want the 

The default list of excluded directories is: :file:`/mnt`,
:file:`/dev`, :file:`/media`, :file:`/sys`, :file:`/tmp`,
:file:`/var/cache` and :file:`/proc`. It is a bad idea to include
any of these directories, because they may cause the backup process to
fail.

. It is a bad idea to include
fail.

A full copy of a Zentyal server with all its modules, but without user
data will be around 300MB.

.. figure:: images/backup/ebox_ebackup_03.png
   :scale: 80
   :alt: Inclusion and exclusion list

   Inclusion and Exclusion list

You can check the backups status in the :guilabel:`Remote Backup Status` section.
Within this table, you can see the type of backup; full or incremental and
the execution date.

 section.

.. figure:: images/backup/ebox_ebackup_02.png
   :scale: 80
   :alt: Backup status

   Backup status

There are two ways of restoring a file. Depending on the file size or the
directory you want to restore.

It is possible to restore files directly from Zentyal server's control
panel. In the :menuselection:`System --> Backup --> Restore files` section you
have access to the list of all the files and directories
contained in the remote backup, and the dates of the different
versions you can restore.

panel. In the 

 section you

If the path to restore is a directory, all its contents will be restored,
including sub-directories.

The file will be restored with its contents on the selected date, if the
file is not present in the backup that day. The version found in the former
backups will be restored. If there is no copy of the file in any of the
versions, you will be notified with an error message.

The files shown in the interface are the ones that are present in the last
backup. The files that are stored in former copies, but not in the last one,
are not shown, but they can be restored using the command line.

You can use this method with small files. For big files, the process is
time consuming and you can not use the Zentyal web interface while the
operation is being made. You have to be especially careful with the type
of file you are restoring. Normally, it will be safe to restore data
files that are not being used by applications at the current time. These
data files are located in the directory :file:`/home/samba`. On the
other hand, restoring system file of directories like :file:`/lib`,
:file:`/var` or :file:`/usr` while the system is running can be
very dangerous. **Don't** do this unless you are really sure of what
you are doing.

data files are located in the directory 

.. figure:: images/backup/ebox_ebackup_04.png
   :scale: 80
   :alt: Restore a file

   Restore a file

The big files and the directories and system files should be restored
manually. Depending on the file, you can do it while the system is
running. On the other hand, to rescue system directories, use
a rescue CD, as explained later.

In any case, you must be familiar with the tool used by this module
**duplicity** [#]_. The restoration process of a file or directory is very
simple. You just execute the following command::

. The restoration process of a file or directory is very
simple. You just execute the following command:

duplicity restore --file-to-restore -t 3D <file or directory to restore> <remote URL and arguments> <destination>

*duplicity*: Encrypted bandwidth-efficient backup using the
rsync algorithm <http://duplicity.nongnu.org/>.

: Encrypted bandwidth-efficient backup using the
rsync algorithm <

The *-t* option is used to select the date you want to restore. In this case
*3D* means three days ago. Using *now* you can restore the latest copy.

 option is used to select the date you want to restore. In this case

You can obtain *<Remote URL and arguments>* reading the note that is included
above the :guilabel:`Restore files` section in Zentyal.

.. figure:: images/backup/ebox_ebackup_05.png
   :scale: 80
   :alt: Remote URL and arguments

   Remote URL and arguments

For example, if you want to restore the file
:file:`/home/samba/users/john/balance.odc` you will execute the
following command:

# duplicity restore --file-to-restore \
home/samba/users/john/balance.odc scp://backupuser@192.168.122.1 \
--ssh-askpass --no-encryption /tmp/balance.odc

home/samba/users/john/balance.odc scp://backupuser@192.168.122.1 --ssh-askpass --no-encryption /tmp/balance.odc

The command shown above will restore the file in :file:`/tmp/balance.odc`.
If you need to overwrite a file or a directory during a restore operation,
you need to add the option *--force*, otherwise *duplicity* will refuse
to overwrite files.

.
you need to add the option 

 to a remote host, since they are
has 

, part of the commercial offering
and the data kept on your server. Likewise, the free Basic Subscription 

 , designed

To recover from a total disaster, you will boot the system using a rescue CD-ROM that
includes the backup software *duplicity*, for example *grml* [#]_

As important as knowing how to make backups is to know the procedure
to perform a recovery during a critical event. You need to be able to restore the
service as soon as possible after the system is rendered non operative by a disaster.

You will download the *grml* image and boot the host with it.
You can use the parameter *nofb* in case you experience problems with screen size.

.. figure:: images/backup/ebox_restore_01.png
   :scale: 80
   :alt: Grml boot

   Grml boot

Once the boot process is finished,  go to a command line interpreter
pressing :kbd:`enter`.

pressing 

.. figure:: images/backup/ebox_restore_02.png
   :scale: 80
   :alt: Starting a command line interpreter

   Starting a command line interpreter

If your network is not correctly configured, you can execute `netcardconfig`
to configure it.

FIXME: aqui hay linea de comandos en el curso, aunque pusimos como objetivo que no fuera necesario

The next step is to mount the hard drive of your system. In this case, let's
suppose that your root partition is :file:`/dev/sda1`. So execute::

suppose that your root partition is 

The former command will mount the partition in the directory :file:`/mnt`. In this
example you perform a complete restore. First, you will delete all the existing
directories in the partition. Obviously, if you do not do a complete restoration, this
step is not necessary.

. In this

Before doing a complete restore, you need to restore the :file:`/etc/passwd`
and :file:`/etc/group`. Otherwise you may have problems restoring files with
an incorrect owner. The problem appears because *duplicity* stores the usernames
and groups and not the numerical values. Therefore there will be problems if you restore
the files to a system where the users and groups have different UID or GID. To avoid
this problem, you will overwrite :file:`/etc/passwd` and :file:`/etc/group` in the
rescue system. Execute::

. Otherwise you may have problems restoring files with
an incorrect owner. The problem appears because 

 stores the usernames
this problem, you will overwrite 

# duplicity restore --file-to-restore etc/passwd \
  scp://backupuser@192.168.122.1 /etc/passwd --ssh-askpass \
  --no-encryption --force

# duplicity restore --file-to-restore etc/group \
  scp://backupuser@192.168.122.1 /etc/group --ssh-askpass \

When using *SCP*, you have to execute `sudo ssh
operation, the backup will not be possible, because the connection

Now you can proceed with the complete restore running *duplicity* manually::

# duplicity restore  scp://backupuser@192.168.122.1 /mnt/ --ssh-askpass --no-encryption --force

Finally, you have to create the excluded directories, and clean the temporary
directories::

directories:

# mkdir -p /mnt/dev
# mkdir -p /mnt/sys
# mkdir -p /mnt/proc
# rm -fr /mnt/var/run/*
# rm -fr /mnt/var/lock/*

The restoration process is finished and you can boot in the original system.

Apart from the files, additional data is stored to allow the direct restoration
of some services. This data includes:

In the tab *Service restoration* both can be restored for a given date.

The security copy of Zentyal configuration contains the configuration of all
the modules that have been enabled at least once, all the LDAP
data and any other additional files needed by the modules to function
properly.

You have to be careful when restoring Zentyal configuration because all the
current configuration and LDAP data will be replaced. Nevertheless, for the
case of configuration not stored in LDAP, you have to click "Save changes"
to make this effective.

.. figure:: images/backup/ebox_ebackup_restore_services.png
   :scale: 80
   :alt: Restoring services

   Restoring services

includes the backup software 

Add a virtual disk of at least 3GB of size to the virtual machine you are
using to perform the exercises. Create a partition and a file system, then
mount it in the system in :file:`/mnt/backup`.

mount it in the system in 

Simulate a disaster in the system deleting the directories
:file:`/var/lib` and :file:`/etc`. Boot into *rescue mode*
and restore the system.

Make a backup of the configuration only. After this, add a some users
and groups. After restoring this copy, check that all previous
modifications have been lost.

Repeat the last exercise, but with the command line tools
:command:`make-backup` and
:command:`restore-backup`. Modify the configuration of
the objects module and restore only the objects module.

. Modify the configuration of

The loss of data in a system is a common occurrence, and you have to be prepared
for it. Hardware failure, software failure or human error can cause irreparable
damage in the system or total loss of important data.

Therefore, it is critical to have a proper **procedure to perform, check and restore
backups**, both for server configuration and for data.

One of the first decisions you have to take is, will you use
**full copies**, meaning a full copy of all data - or **incremental copies**,
which starting from a first copy will just update the differences. The incremental
copies reduce the space needed to make a backup, but they require additional logic
for the backup restoration. The usual decision is to make incremental copies
regularly and full backups to an external support less often. The decision depends
mainly on your needs and the available storage space.

,

Another important decision is whether you are going to save the
backups on the same host or on a remote host. Using a remote host
offers better security, due to the physical separation. A hardware
or software failure, a human error or an intrusion will not affect
the integrity of backups. To minimise this risk, the
backup server should be dedicated exclusively to this task and not
to other services. Using non-dedicated servers making backups
of each other is definitely a bad idea, since a compromise in one
of them will compromise the other one.

Dar un enlace directo al paquete de la última versión cuando lo
tengamos.

A **directory service** [#]_ is an information database with a
structure available for a set of users. An example of a directory
service can be the Yellow Pages, which contains names, addresses
and contact numbers from different companies, classified by
category, and indexed in a way that helps finding what
you are looking for.

Zentyal integrates **OpenLDAP** [#]_ as a directory service, with **Samba**
[#]_ to implement the domain controller functionality of Windows and also file and
printer sharing.

 to implement the domain controller functionality of Windows and also file and

The OpenLDAP server uses TCP/389 by default, the LDAP version that
runs over SSL (delivering an extra layer of security and ciphering) uses the port
TCP/636.

Samba server listens to the ports 139 and 445 of TCP by default.

To learn more about the directory services or the LDAP protocol, it is recommended
to read the associated pages in wikipedia.

To learn more about OpenLDAP, it is recommended to read the basic
guide [#]_.

guide 

In order to know how to configure the OpenLDAP server using command
line in Linux, it is recommended to read the corresponding Ubuntu
Server documentation [#]_

Server documentation 

There are several types of directory services: local or global
administration; containing information from employees' name,
telephone numbers and domain names with their associated IP
addresses. Installed as simple services on a local network or as a
series of databases located geographically but
interconnected. Nevertheless, they always share some common
features; such as having the information structured in a flexible and
changeable way, having advanced search capabilities and, in the case of
distributed directories, containing the information replicated in
different servers.

To ease data extraction from a directory server, Zentyal uses
**LDAP** [#]_, a protocol that supports data queries from directory
servers using standard TCP/IP model. LDAP follows the client-server
model, where multiple clients can connect to a server to perform
queries and gather results.

, a protocol that supports data queries from directory

In a SMB, the directory services are mainly used to store and organise the
information related to the users and groups of the organisation. Thus the
directory services act as a central authority through which the users of an
organisation can securely identify. Also, it allows system administrators to
assign access privileges to the resources depending on this user/groups schema,
making the deployment of security policies easier.

In order to make the shared resources administration easier there is a difference
between **users** and **groups**, allowing you to assign access privileges both
to individuals and to categories.

between 

, allowing you to assign access privileges both

 is an information database with a

Go to the menu
:menuselection:`Users and Groups --> Mode`, the module will act as a master LDAP
directory and the **Distinguished Name** (DN) [#]_ of the directory will be
established using the host name. If you want to configure a different DN, you
can change this on the text field :guilabel:`LDAP DN`.

If you want to change the operation mode of the users and groups module , you can
do this by running the script::

 # sudo /usr/share/zentyal-users/reinstall

When executed, it completely removes the information stored in LDAP, erasing all the

existing users and groups and reinstalling from scratch in a empty directory that can
be configured in a different mode.

do this by running the script:

As mentioned earlier, Zentyal is designed in a modular way, allowing the
system administrator to distribute the services between several hosts in the network.
To make it real, the **users and groups** module can be configured using a
master/slave architecture in order to share users between the different servers.

To make it real, the 

 module can be configured using a

Every entry on a LDAP directory has a unique identifier called
**Distinguished Name** which has some similarities with the concept
of a complete path on a file system.

 which has some similarities with the concept

.. figure:: images/directory/users-mode.png
   :scale: 80

   Zentyal users mode

Other servers can be configured to use a master as a source for their users and
they become slave servers. To do this, choose *slave* mode in
:menuselection:`Users and Groups --> Mode`. The slave configuration needs two
more fields, the *IP address* or *name of the host* containing the master directory
and its *LDAP password*. This password is not the Zentyal password, but one automatically
generated when you enable the **users and groups** module. You can obtain this password
in the field *Password* using the :menuselection:`Users and group --> LDAP data` option
in the master server.

they become slave servers. To do this, choose 

. This password is not the Zentyal password, but one automatically
generated when you enable the 

.. figure:: images/directory/ldap-info.png
   :scale: 80

   LDAP info

There is another requirement to register a slave server against a master.
The master needs to be able to resolve the name of the slave machines using
DNS. To do this, you need to configure the DNS service in Zentyal, adding a new
domain with the slave host name and the IP address.

If the **firewall** module is enabled in the master server, it must be configured
in a way that it will allow the incoming traffic from the slaves. By default, the firewall
forbids this traffic, so it is necessary to make the required adjustments before
continuing.

 module is enabled in the master server, it must be configured

Once all the parameters have been established and the host name of the slave can be
resolved from the master, the slave can be registered in the master Zentyal server
enabling the module **users and groups** in :menuselection:`Module status`.

enabling the module 

The slaves will create a copy of the master directory when they register for the
first time, and it will be automatically maintained when new users and groups are
added. You can see the slave list in the :menuselection:`Users and groups -->
Slave status` menu in the master Zentyal machine.

added. You can see the slave list in the 

.. figure:: images/directory/slave-status.png
   :scale: 80

   Slave status

The modules which have users like **mail** and **filesharing** can now be installed
in the slaves and they will use the users configured in the master Zentyal
directory. Some modules need extra actions to be executed when you add users, for instance
**filesharing**, which needs to create the user directories. To do so, the
master will notify the slaves about the new users and groups when they are created
, providing the opportunity for the slaves to perform the associated actions.

 can now be installed

, which needs to create the user directories. To do so, the

There can be some problems running these actions in some circumstances, for example
if one of the slaves is powered down. In this case, the master will remember that
there are remaining actions that must be performed and will periodically
retry. The system administrator can also check the slaves status on the menu
:menuselection:`Users and groups --> Slave status` and then force the retry of the
actions manually at any time. From this section it is also possible to remove a slave.

 and then force the retry of the

There is an important limitation of the master/slave
architecture. The master Zentyal server can not have
modules which depend of **users and groups**, for example
**filesharing** and **mail**. If the master has any of these modules
installed, they must be un-installed before trying to register any
slave.

modules which depend of 

. If the master has any of these modules
slave.

 of the directory will be
can change this on the text field 

These packages can be downloaded, for the different versions of Zentyal from
the download page of the project [#]_

the download page of the project 

Create the user **peter** and add him to the group **accounting**

**Action:**
Go to :menuselection:`Users --> Add user`. Fill the different
fields for your new user. You can add the user peter to the group
**accounting** from this screen.

Click on :guilabel:`Add`.

Effect:
  The user has been added to the system and to the group **accounting**.
  You can check it by viewing the user list.

. Fill the different

Effect:
The user has been added to the system and to the group **accounting**.
You can check it by viewing the user list.

Activate the module **users and groups**. Go to
:menuselection:`Module status` and enable the module
in case it is not enabled yet.

Effect:
  The module is active and ready to be used.

Go to :menuselection:`Users and Groups --> Groups`. Add
**accounting** as a group. The parameter *comments* is optional.

Effect:
  The group **accounting** has been created. Saving the changes is not
  required here, because the actions of LDAP take effect immediately.

Effect:
The group **accounting** has been created. Saving the changes is not
required here, because the actions of LDAP take effect immediately.

 has been created. Saving the changes is not

Activate the **User corner** and change the password for **peter**
using this module.

proponer un ejercicio B que incluya configuracion de master/slave y otro ejercicio C con adsync

After configuring the Zentyal server as master, from :menuselection:`Users and
Groups --> LDAP Configuration Options` you can check the current LDAP
configuration and perform some adjustments related to the configuration of PAM
authentication on the system.

:menuselection:`Users and
Groups --> LDAP Configuration Options`

 you can check the current LDAP

In the upper part, you can see the :guilabel:`LDAP Information`:

.. figure:: images/directory/Zentyal_ldap_settings.png
   :scale: 80
   :alt: LDAP configuration in Zentyal

   LDAP configuration in Zentyal

The password of other services and applications that want to use this LDAP
server. If you want to configure a Zentyal server as a slave of
this server, this is the password that will be used.

.. figure:: images/directory/Zentyal_pam_settings.png
   :scale: 80
   :alt: PAM Settings in Zentyal

   PAM Settings in Zentyal.

Enabling PAM, you will allow the users managed by Zentyal to also act as normal
system users, rendering it possible to start sessions in the server.

You also specify in this section the default command interpreter for your users.
This option is initially configured as *nologin*, blocking the users from starting sessions.
Changing this options will not modify the existing users in the system, and
will only be applied to the users created after the change.

This option is initially configured as 

, blocking the users from starting sessions.

You can create a group from the :menuselection:`Users and groups -->
Groups` menu. A group will be identified by its name, and can also contain a
description.

 menu. A group will be identified by its name, and can also contain a

.. figure:: images/directory/01-groupadd.png
   :scale: 80

   Adding a group to Zentyal

Going to :menuselection:`Users and groups --> Groups` you can see all the
existing groups, edit or delete them.

While you are editing a group, you can choose the users that belong to the group,
and also the information associated with the modules in Zentyal that have some
specific configuration associated with user groups.

.. figure:: images/directory/02-groupedit.png
   :scale: 80

   Editing a group

Create an alias for a mail address that will forward to all the users of a group.

Assign access permissions of different *groupware* applications to the users of a group.

The users created from the :menuselection:`Users and Groups-->
Users` menu, is where you need to add the following information:

.. figure:: images/directory/03-useradd.png
   :scale: 80

   Adding a user to Zentyal

:guilabel:`User name`:
Name of the user on the system, it will be the name used in the
authentication processes.

Password that will be used in the authentication processes.
This information will have to be typed twice to avoid typing
errors.

errors.

:guilabel:`Group`:
Is possible to add the user to a group during the creation process.

From :menuselection:`Users and Groups --> Users` you can obtain a list of
the users, edit or delete them.

.. figure:: images/directory/04-users.png
   :scale: 80

   List of users in Zentyal

While editing a user, you can change all the details, except the
user name and the information that is associated with the installed Zentyal
modules. These contain some specific configuration details assigned to users.
You can also modify the list of groups that contain this user.

.. figure:: images/directory/05-useredit.png
   :scale: 80

   Editing a user

Create an account for the filesharing or PDC with a personalised quota.

Enable or disable the user account for Zarafa and check if it has
administrator rights.

In a master/slave configuration, the basic user and groups fields can be edited
in the master, while the rest of attributes related with other installed modules
in the slave will be edited from the slave.

To ensure the proper functioning of a master/slave LDAP deployment in Zentyal
you should verify the following points:

* Both the master and the slaves have the NTP module installed, enabled and
  synchronizing against a NTP server.

* The master can resolve the slaves' hostnames, to check this you can use:
  'ping slave_name'. You can have these names available in your DNS server,
  or add these entries in the '/etc/hosts' file of the master.

* The master can connect to the SOAP port of the slaves (same port as the
  administrative interface) using SSL. To check this use::

    openssl s_client -connect slave_name:port

* The slaves can connect to the LDAP port of the master, to check this you can
  use: ldapsearch -h master_ip -b 'dc=name, dc=distinguished_name' -x -w.

Both the master and the slaves have the NTP module installed, enabled and
synchronizing against a NTP server.

The master can resolve the slaves' hostnames, to check this you can use:
'ping slave_name'. You can have these names available in your DNS server,
or add these entries in the '/etc/hosts' file of the master.

The master can connect to the SOAP port of the slaves (same port as the
administrative interface) using SSL. To check this use::

  openssl s_client -connect slave_name:port

administrative interface) using SSL. To check this use:

The slaves can connect to the LDAP port of the master, to check this you can
use: ldapsearch -h master_ip -b 'dc=name, dc=distinguished_name' -x -w.

If you are going to deploy a master/slave scenario over an insecure network, such as
the Internet, to protect the exchanged information it is strongly recommended to first
link the servers using VPN, and then configure the replication using the VPN internal
addresses.

The user's data can only be modified by the Zentyal administrator, which
can be inefficient when the number of users to be managed becomes too
big. Administration tasks like changing the password of a user can be
very time consuming. For this reason, you need the **User's corner**. This
corner is a Zentyal service designed to allow the users to change their own
data. This functionality has to be enabled like the rest of the modules.
The user's corner is listening on another port different to other processes to enhance the
system security.

very time consuming. For this reason, you need the 

. This

.. figure:: images/directory/06-usercorner-server.png
   :scale: 80

   Configure user's corner port

Once the user enters his/her name and password, he/she can perform changes in his
personal configuration. User's corner offers the following functionality:

Configure an external personal account to retrieve the mail and
synchronise it with the content of the mail server in Zentyal.

.. figure:: images/directory/07-usercorner-user.png
   :scale: 80

   Change the current password in user's corner

Once the Windows server is ready, you can proceed to configure
Zentyal from :menuselection:`Users and groups --> Mode`. Here,
you must enter the following data:

Zentyal from 

:guilabel:`Mode`:
Choose the :guilabel:`Windows AD slave` option.

.. figure:: images/adsync-howto/ebox-users-mode.png
   :scale: 80
   :alt: User mode in Zentyal

   User mode in Zentyal

Once you have entered these values, you can activate the
:guilabel:`Users and groups` module and save the changes. When
Zentyal is prepared to work in this mode, the authentication information
can be inserted from the Windows server from :menuselection:`Users and groups -->
Windows AD synchronisation`.

 module and save the changes. When
can be inserted from the Windows server from 

:menuselection:`Users and groups -->
Windows AD synchronisation`

:guilabel:`AD User`:
Name of the user that you have created in the Windows host.

:guilabel:`Reception port`:
Port entered during the Windows server configuration.

:guilabel:`AD Secret key`:
The 16 character key used during the configuration in the Windows host.

The passwords assigned to existing users must
be reassigned again (or changed) and the Zentyal server notified. Once the users
are synchronised, these updates can take up to 5 minutes to complete.

Apart from the master-slave configuration that can be set-up between
different Zentyal hosts, a Zentyal server can be used in the role of
slave like a Windows Active Directory host, acting as master.

The replication can be performed only in one direction, from Windows to Zentyal,
and there are two separate processes for data and for passwords. All the
user data from users and groups will be synchronised through the LDAP protocol.
Nevertheless, the passwords can be transferred through a cyphered TCP communication,
with the server listening in the Zentyal host and the client notifying the passwords
when a new user is created or the password in the master Windows server is modified.

To deploy a scenario with this feature, you will need a working
Zentyal server with an advanced configuration of the users
directory and a Windows server with Active Directory configured. In
the Windows server, you need to install the software that will
perform the slave synchronisation and for the slave machines, you
will need to register the master server.

You need to install a special software package in the Active Directory
server in order to notify the password changes to Zentyal.

Once downloaded and executed, it will launch the configuration tool automatically and you can enter the following data:

:guilabel:`Port`:
You can use the default value or change it to a different one which is available
of the Zentyal host.

:guilabel:`Secret key`:
You can choose any password, as long as its length is at least **16 characters**

:guilabel:`Enable service`:
Check this box if you want to write the data in the Windows registry. It will not
have effect until the server is restarted.

.. figure:: images/adsync-howto/pwdsync-config.png
   :scale: 80
   :alt: Configuration dialogue during installation

   Configuration dialogue during installation

The values for port and secret key have to be entered after the Zentyal host
configuration, as explained in the following section.

To finish the installation, click on the button :guilabel:`Save to Registry
and Exit`. It is not recommended to restart the server yet, as there are some
configuration steps remaining.

. It is not recommended to restart the server yet, as there are some

In the :menuselection:`Start` menu, go to
:menuselection:`Administrative Tools --> Domain security policy`
and activate the complexity requirements for a password as shown in
the figure:

.. figure:: images/adsync-howto/pwd-policy-screenshot.png
   :scale: 80
   :alt: Editing password policy

   Editing password policy.

Now add a user and then assign a password. You have to take into
account that these credentials will be used to connect via LDAP, thus, the relevant
part is the complete name (CN) and not the user name. The recommendation for avoiding
any conflict is to leave fields for name and surname blank then assign the same value
to the :guilabel:`Complete Name` and the :guilabel:`Session startup name`.

to the 

.. figure:: images/adsync-howto/adsync-adduser.png
   :scale: 80
   :alt: Adding the new user eboxadsync

   Adding the new user eboxadsync

Once you have finished this configuration the hosts can be restarted as
described by the installer.

**File sharing** [#]_ is the process by which a series of
files are made available to network users, providing access
to work on them, download them or modify them. The main services
available are *Network File System* (NFS) [#]_, *Andrew
File System* (AFS) and *Common Internet File System* (CIFS). The latter
is the Microsoft Windows file sharing protocol and formerly
known as *Server Message Block* (SMB) [#]_. Therefore, in many contexts
it is called SMB/CIFS.

The ports used by Samba range from 137 to 139 both for **TCP** and **UDP**,
for different services like data transfer or authentication.

Samba is a free implementation of SMB/CIFS for Linux and
Unix; by using CIFS computers can collaborate on Linux
Windows networks acting as servers or clients. In addition, Samba can also
act as a Primary Domain Controller (PDC), authenticating users
in the network, or even as Microsoft Active Directory for Windows-based networks.
This also allows the sharing of directories and printers on the network.
Samba can be installed, not only in Linux servers, but also in Solaris, BSD and
Mac OS X Servers.

Zentyal includes Samba to implement file and printer sharing, and authentication
of users on the network.

For more information about Samba, the project website [#]_ is a good resource.
To get a deeper insight of the operation and implementation of CIFS,
the on-line book *Implementing CIFS* [#]_ is a recommended reference.

 is a good resource.
the on-line book 

To learn how to configure the Samba server via command line
in Linux, read the section about Windows networks in the Ubuntu Server documentation [#]_.

in Linux, read the section about Windows networks in the Ubuntu Server documentation 

The **Samba** servers listen by default on TCP ports 139 and 445.

https://help.ubuntu.com/10.04/serverguide/C/windows-networking.html

A **PDC** [#]_ (Primary Domain Controller) is a Windows server
which authenticates users on the network and maintains the database
directory service for a domain. In the context of Windows networking,
a domain is a concept used by NT servers where users are granted access to
a series of network resources through a unique combination of
username and password.

 (Primary Domain Controller) is a Windows server

This implementation was kept on Windows Servers until the NT version.
From **Windows Server 2000** on, it was replaced by the directory service
**Active Directory**  [#]_, better suited for large organisations.
New versions of Windows, both client and server, remain compatible
with PDC.

From 

, better suited for large organisations.
with PDC.

Samba is able to accurately emulate a *PDC* server on a Linux operative system.

Users access shared files and perform operations on
them (create, read, write) in the same way as they would if
they were in their own computers. However, this information
may be scattered in different places, making location appear transparent.
Ideally, users should notice no difference in
accessing a file stored on his/her computer or server, but they may notice
the latency when accessing files from the network, as well as issues
related to simultaneous editing of files on concurrent updates.

 is the process by which a series of
available are 

 (CIFS). The latter
known as 

Create a user called **rachel** and add her to the **accountancy** group.
After this, create a shared resource for the accountancy group called
**accountancy**. Add the user peter to the accountancy group. Connect to
this resource using peter's credentials and upload a file. Finally,
use rachel's credentials to test whether she can read and write to this
file.

 group.

. Add the user peter to the accountancy group. Connect to
file.

Create a shared resource so peter has access to
`/usr/share/doc`. Then, allow peter read and write access. Now try to
upload a new file as the user peter. What happens?

. Then, allow peter read and write access. Now try to

Create a shared resource called **test**. Allow peter read and write
access and then set rachel as administrator. Log in as peter and upload
a file. Then, log in as rachel and verify that you can delete the file that was uploaded by
peter.

. Allow peter read and write
peter.

Enable the *public_html* directory for the system users through the Web
server module (see :ref:`web-section-ref`). Create a test web page in the
*public_html* directory as peter. Confirm you can access to it through:
`http://<zentyal_ip>/~peter/`.

 directory for the system users through the Web
server module (see 

Define a general quota of 10MB and try to upload a file bigger than
that to your personal directory. What happens? Now, establish a
quota of 50MB with the user peter. If the size of the
file is smaller than 50MB, confirm that there is no problem when
uploading it to peter's personal directory.

Enable the *recycle bin* feature and test it with any share by
deleting a file. What happens? Add an exception for a share and check that the
`RecycleBin` directory does not appear when a file is deleted.

 feature and test it with any share by

Using Nautilus go to :menuselection:`Places --> Network
--> Windows Network`, where you will find your domain, and within
the Zentyal server the shared resources.

, where you will find your domain, and within

.. figure:: images/filesharing/14-gnome-shares.png
   :scale: 70

   Nautilus shares

Keep in mind that personal user directories are not listed during navigation,
so to enter them you should write the address at the search bar. For example, to access
the personal directory *peter*, the user should enter the following address:

the personal directory 

To harness the potential of the PDC as authentication server,
and its **Samba** implementation for Linux, check
the :guilabel:`Enable PDC` box using
:menuselection:`File Sharing --> General Configuration`.

and its 

.. figure:: images/filesharing/06-pdc-enabled.png
   :scale: 80

   PDC enabled

If the :guilabel:`Roaming Profiles` option is enabled, the PDC
will not only authenticate users, but will also store their profiles.
These profiles contain all the user information, including preferences
in Windows, Outlook email accounts and documents.
When a user logs in, the user profile will be retrieved from the PDC server.
Therefore, the user will have access to their work environment on multiple computers.
Before enabling this option, you must consider that the user information
can be several gigabytes in size, therefore the PDC server must contain enough disk space.
You can also configure the :guilabel:`drive letter` to which the
personal user directory will be linked after authenticating against
the PDC in Windows.

 option is enabled, the PDC
You can also configure the 

 to which the

You can set password policies for users through :menuselection:`File Sharing -->
PDC`.

:guilabel:`Maximum password age`, the password must be renewed after the
the set days have passed.

, the password must be renewed after the

:guilabel:`Enforce password history`, this option will force the recording
of password history, making it impossible for the user to use repeated passwords.

, this option will force the recording

These policies are applicable only when you change the
Windows password from a machine that is connected to your
domain. In fact, Windows will force compliance with this policy
as a machine is registered on the domain.

.. figure:: images/filesharing/06-pdc-settings.png
   :scale: 80

   PDC settings

By using :menuselection:`My network places --> All the network`
you can find the chosen domain. After accessing the chosen server the shared
resources will appear and these can be mapped as shared resources.

.. figure:: images/filesharing/14-windows-shares.png
   :scale: 70

   Windows shares

The file-sharing services are active when the **file sharing**
module is active, even if the :guilabel:`PDC` is not.

File sharing is integrated with users and
groups. Each user has a personal directory and
each group can be assigned a shared directory.

The user's personal directory is automatically shared and can only
be accessed by the user.

It is also possible to create a shared directory for a group using
:menuselection:`Users and Groups --> Groups --> Edit group`. All group members
have access to that directory and can read or write to all the files
and directories within the shared directory.

. All group members

.. figure:: images/filesharing/10-share-group.png
   :scale: 80

   Creating a shared directory for a group

To configure the general settings of the file sharing service,
go to :menuselection:`File Sharing --> General configuration`.

go to 

.. figure:: images/filesharing/06-sharing.png
   :scale: 80

   General configuration of file sharing

The :guilabel:`domain` is set to work within the *Windows* local network,
and the :guilabel:`NetBIOS name` is used to identify the Zentyal server.
You can use a long :guilabel:`description` to describe the domain.
In addition, there is the option to set a
:guilabel:`quota limit`. Using :guilabel:`Samba Group` it is possible
to configure an exclusive group where member users are assigned an account for
file sharing.

 to describe the domain.

 it is possible

To create a shared directory, use :menuselection:`File Sharing --> Shares`
and click :guilabel:`Add new`.

.. figure:: images/filesharing/07-share-add.png
   :scale: 80

   Adding a new share

:guilabel:`Enabled`:
Leave it checked if this directory needs to be
shared. Disable to stop sharing.

:guilabel:`Share path`:
Directory path to be shared. You can create a sub-directory within the
Zentyal specific directory */home/samba/shares*, or use an existing
file system pathway by selecting
:guilabel:`Filesystem path`.

Zentyal specific directory 

:guilabel:`Comment`:
A more detailed description of the shared directory simplifies
management of shared assets.

:guilabel:`Guest access`:
Enabling this option allows a shared directory to be accessible without
authentication. Any other access settings will be ignored.

.. figure:: images/filesharing/08-shares.png
   :scale: 80

   List of shares

Shared directories can be edited using :guilabel:`Access
control`. By clicking on :guilabel:`Add new`, you can assign
read, read/write or administration permissions to a user or
group. If a user is a shared directory administrator, he/she can read, write
and delete any user files within that directory.

, you can assign

The difference between the administrator profile and "read and write"
is that administrator privileges can not be restricted whereas "read write" users can.

.. figure:: images/filesharing/09-share-acl.png
   :scale: 80

   Adding a new ACL (Access Control List)

You can also create a share for a group using
:menuselection:`Users and Groups --> Groups`. All group members
will have access: they can write their own files and
read all the files in the directory.

If you want to store deleted files in a special directory called
*RecycleBin*, you can check the :guilabel:`Enable recycle bin` box using
:menuselection:`File Sharing --> Recycle bin`. If you do not want to use this
for all shared resources, add exceptions using
:guilabel:`Resources excluded from Recycle Bin`. Other
default settings for this feature, such as the directory name,
can be modified using the file :file:`/etc/zentyal/samba.conf`.

. If you do not want to use this

. Other
can be modified using the file 

.. figure:: images/filesharing/recycle-bin.png
   :scale: 80

   Recycle bin

Using :menuselection:`File Sharing --> Antivirus` virus scanning of
shared resources can be enabled and disabled. Exceptions can also be defined
where virus scanning is not required. To use this feature the package
**samba-vscan** must be installed on the system. Also, the Zentyal
**antivirus** module must be installed and enabled.

 virus scanning of

To configure the PDC authentication, you need to use an account with
administrator privileges on your server. This can be done by using
:menuselection:`Users and Groups--> Users --> Sharing files account (PDC)`.
In addition, you can set a :guilabel:`Disk quota`.

:menuselection:`Users and Groups--> Users --> Sharing files account (PDC)`

.. figure:: images/filesharing/11-share-user.png
   :scale: 80

   Configuration of PDC authentication

Next, go to another machine within the same local area network (bear in mind that
the SMB/CIFS operates in broadcast mode) using a Windows version that is able to work with CIFS
(e.g. *Windows XP Professional*). Now using :menuselection:`My PC -->
Properties`, launch the wizard to assign a *network ID* to the machine.
For each question, assign the username and password of the user with
admin privileges. For the domain, set the name written in
:menuselection:`File Sharing`. Keep in mind that the name of the machine
can be the same as long as it does not cause a collision with the rest of devices
already added to the domain. After completing the wizard, you must
reboot.

(e.g. 

 to the machine.

. Keep in mind that the name of the machine
reboot.

Once signed in with one of the users, go to
:menuselection:`My PC` and add network partition. A resource with a quota set during
the configuration will be shown.

 and add network partition. A resource with a quota set during

.. figure:: images/filesharing/15-windows-partition.png
   :scale: 80

   Windows partition

In order to join a workstation to a domain which controller is in a different
subnet, you will need to establish Zentyal as a WINS server for that PC, and
then you can join it to the domain using the usual procedure. In a similar way,
you should set Zentyal as a WINS server for PCs installed in different subnets
so that machines can be seen whilst browsing anywhere within the Microsoft network,
even through VPN connections.

Once the service is running you can share files over
Windows or Linux.

Using Konqueror you just need to write in the browsing bar ``smb://`` to see
the Windows network in which you can find the specified domain:

 to see

.. figure:: images/filesharing/14-kde-shares.png
   :scale: 70

   Konqueror shares

If you use an *ADSL router* PPPoE [#]_ (a connection method used by some Internet
providers), you can also configure these types of connections. To do this, you only
have to select :guilabel:`PPPoE` and introduce the :guilabel:`Username` and
:guilabel:`Password` supplied by your provider.

 (a connection method used by some Internet
have to select 

Zentyal connects to a provider to obtain a public IP address avoiding any
translation of the network address (NAT) between the server and Internet. If
you are using this feature in the *multirouter* [#]_ scenario, you must not forget
to create a rule to ensure the connections to the provider always use the same
gateway.

you are using this feature in the 

 scenario, you must not forget
gateway.

Once you have installed Zentyal, you can access to the administrative web
interface of Zentyal both through its own graphical environment included in
the installer and from anywhere on the internal network, using the address:
https://ip_address/, where *ip_address* is the IP address or the hostname
on which Zentyal is installed. Because access is through HTTPS, the first time
it is accessed the browser will ask you whether you trust the site. You
simply accept the self-generated certificate.

 is the IP address or the hostname

To access to the web interface, you must use Mozilla Firefox. Please
note that other browsers such as Microsoft Internet Explorer are not
supported.

The first screen asks for the username and password. The user created during the
installation and any other user of the *admin* group can authenticate as administrator.

installation and any other user of the 

.. figure:: images/intro/login.png

   *Login*

Once authenticated, you will see the administrative interface, this is divided in
three main parts:

Left side menu:
Contains links to all the **services** that can be configured by using
Zentyal, separated into categories. When you select a service in this
menu, a sub menu might appear to configure a particular requirement in the
selected service.

 that can be configured by using

.. figure:: images/intro/sidebar.png

   Side menu

Top menu:
Contains **actions**: save the changes made in the contents
to ensure the changes are effective, and log out.

: save the changes made in the contents

.. figure:: images/intro/topbar.png
   :scale: 80

   Top menu

Main content:
The content that occupies the central part, consists of one or more forms or
tables with information about **service configuration** that are selected through the
left side menu and its sub menus. Sometimes, in the top, you can see a bar with
tabs: each tab represents a different subsection within the section you
have accessed.

tables with information about 

 that are selected through the

.. figure:: images/intro/content.png
   :scale: 80

   Contents of a form

Dashboard is the initial interface screen. It contains a series of
*widgets* that can be configured. You can reorganise the widgets at
all times by clicking on their titles and dragging them.

 that can be configured. You can reorganise the widgets at

By clicking on :guilabel:`Configure Widgets` the interface changes,
allowing you to remove and add new *widgets*. To add a new widget,
you need to search for it using the top menu and drag it to the central
section. To remove a widget, click on the X in the upper right corner
of the window.

. To add a new widget,

.. figure:: images/intro/configure_widgets.png
   :scale: 50

   *Dashboard* configuration

One of the important *widgets* in the *Dashboard* displays the status
of all modules installed on Zentyal.

.. figure:: images/intro/widget_module_status.png
   :scale: 75

   *Widget* showing status of the modules

The image shows the status of a service and the action you can carry
out for this service. The different statuses are:

Running:
The service is running and listening to client connections.
You can restart a service using :guilabel:`Restart`.

You can restart a service using 

Running unmanaged:
If you haven't enabled the module yet, it will be running
with the default configuration set by the distribution.

Stopped:
The service is stopped either because the administrator has stopped it
or because a problem has occurred. You can restart the service by
clicking on :guilabel:`Restart`.

clicking on 

Disabled:
The module has been explicitly disabled by the administrator.

Zentyal uses a modular design in which each module manages a different
service. To configure each of these services you must enable the
corresponding module from :menuselection:`Module Status`. All those
functions that have been selected during the installation will be
enabled automatically.

corresponding module from 

. All those

.. figure:: images/intro/module_status.png
   :scale: 50

   Configuration of the status module

Each module may have dependencies on others modules in order to work. For
instance, DHCP module needs to have the network module enabled so
that it can serve IP addresses through the configured network
interfaces. The dependencies are shown in the :guilabel:`Depends`
column and until these are enabled, you can't enable the
module.

interfaces. The dependencies are shown in the 

module.

The first time you enable a module, you are asked to accept the
set of actions that will be carried out and configuration files
that will be overwritten. After you have accepted all the
actions and listed files, you must save changes in order to apply the
configuration.

.. figure:: images/intro/module_enable.png
   :scale: 50

   Confirmation to enable a module

An important feature to consider when working with Zentyal is the way
configuration changes are applied when made through the interface. Initially,
changes must be accepted in the form, then to make these
changes effective and apply them permanently you must click on
:guilabel:`Save Changes` in the top menu. This button will change to red
if there are any unsaved changes. Failure to follow this procedure will
result in the loss of all changes made during the session
once you end it. An exception to this rule is the users and groups
management: here the changes are applied directly.

 in the top menu. This button will change to red

.. figure:: images/intro/save_changes.png
   :scale: 50

   Save Changes

If you change the network interface configurations, firewall or
administrative interface port, you might loose the connection.
If this is the case you should change the URL in the browser or
reconfigure through the local GUI.

There are several parameters in the general configuration of Zentyal that can be
modified in :menuselection:`System --> General`.

modified in 

.. figure:: images/intro/general.png
   :scale: 50

   General configuration

Password:
You can change the password of an user. It is necessary to introduce
 his/her :guilabel:`Username`, :guilabel:`Current password`,
 :guilabel:`New password` and to confirm the password again in the
 :guilabel:`Change password` section.

his/her :guilabel:`Username`, :guilabel:`Current password`,
:guilabel:`New password` and to confirm the password again in the
:guilabel:`Change password` section.

Language:
You can change the interface language using
:guilabel:`Select a language`.

Time Zone:
You can specify city and country to adjust your time zone offset.

Date and Time
You can specify the date and time for the server, as long as you are
not synchronizing automatically with an external NTP server.

Administrative interface port:
By default, it is the HTTPS port 443, but if you want to use it for the web
server, you must change it to another port and specify it in the URL when
you access https://ip_address:port/.

you access 

Hostname:
It is possible to change the *hostname* or the hostname, for
example *zentyal.home.lan*. The hostname is helpful so the server can be
identified from other hosts in the same network.

. The hostname is helpful so the server can be

Once you have completed the installation, if you need the Zentyal server to be useful
and to provide services to clients, you must connect them to the network. The
easiest way to do this is by connecting to a router that normally, will have a
DHCP server that assigns you an address, DNS server and gateway automatically.

Access the Zentyal interface, go to :menuselection:`Network --> Interfaces` and
as network interface, select *eth0* and *DHCP*.
Click on :guilabel:`Change`.

Effect:
  You have enabled the button :guilabel:`Save Changes` and the network
  interface holds the entered data.

Effect:
You have enabled the button :guilabel:`Save Changes` and the network
interface holds the entered data.

Go to :menuselection:`Module status` and enable the **Network** module.
To do this, check the box in the :guilabel:`Status` column.

Effect:
  Zentyal asks for permission to overwrite some files.

Read the changes that will be made in each modified file and grant
Zentyal the permission to overwrite them.

Effect:
  The :guilabel:`Save Changes` button has been enabled and some of the modules that
  depend on **network** now can be enabled.

Effect:
The :guilabel:`Save Changes` button has been enabled and some of the modules that
depend on **network** now can be enabled.

 button has been enabled and some of the modules that
depend on 

:guilabel:`Save changes`.

Effect:
  Now Zentyal manages the network configuration.

Go to :menuselection:`Network --> Diagnosis tools`.
Ping zentyal.org.

Effect:
  As a result, you are shown three successful connection attempts to the
  Internet server.

Effect:
As a result, you are shown three successful connection attempts to the
Internet server.

Go to :menuselection:`Network --> Diagnosis tools`. Run a traceroute
to zentyal.org.

Effect:
  As a result, you are shown a route of all the intermediate routers
  the packets traverse until they reach the destination host.

Effect:
As a result, you are shown a route of all the intermediate routers
the packets traverse until they reach the destination host.

You can decide to install everything on a single host or to separate
the different services into several hosts, depending on the
requirement characteristics of each deployment.

The image :ref:`zentyal-net-img-ref` shows the different locations a Zentyal
server can take within a network, both working as a link between
networks or as a server within the network itself.

 shows the different locations a Zentyal

In this documentation you will find out how to configure Zentyal as a gateway
and firewall. And of course you will also see how to configure Zentyal when
it acts as another server within a network.

.. figure:: images/intro/multiple.png
   :scale: 50

   Locations in the network

To check that the network has been configured correctly, you can use the
tools available in :menuselection:`Network --> Diagnosis`.

tools available in 

**Ping** is a tool that uses the ICMP network diagnosis protocol to observe
whether a particular remote host is reachable by means of a simple "echo
request".

 is a tool that uses the ICMP network diagnosis protocol to observe
request".

.. figure:: images/intro/network_ping.png
   :scale: 50

   Network diagnosis tools, **ping**

You can also use the **traceroute** tool that is used to determine the route taken by
packages across different networks until they reach a given remote host.

 tool that is used to determine the route taken by

.. figure:: images/intro/network_traceroute.png
   :scale: 80
   :alt: Herramienta traceroute

   Tool **traceroute**

Also, you can use the **domain name resolution** tool, which is used to verify
the correct functioning of the name service.

 tool, which is used to verify

.. figure:: images/intro/network_dig.png
   :scale: 80
   :alt: Domain name resolution

   Domain name resolution

Through :menuselection:`Network --> Interfaces` you can access the configuration
of each network card detected by the system and you can select between a static
configuration (manually configured), dynamic (DHCP configuration), VLAN (802.1Q)
trunk, PPoE or *bridged*.

 you can access the configuration
trunk, PPoE or 

In addition, you can define each interface to be :guilabel:`External` if it is
connected to an external network, such as the Internet, in order to apply
stricter firewall policies. If you don't do this, the interface is considered
internal, connected to a local network.

 if it is

When you configure an interface to serve DHCP, not only do you configure the IP address,
but also the DNS servers and gateway. This is usual for hosts within the local
network or for external interfaces connected to the *ADSL routers*.

network or for external interfaces connected to the 

.. figure:: images/intro/network_ifaces_dhcp.png
   :scale: 50

   DHCP configuration of the network interface

If you decide to configure a static interface you must specify the IP address and the
network mask. You can also associate one or more :guilabel:`Virtual Interface` to
this real interface to use additional IP addresses.

network mask. You can also associate one or more 

These additional addresses are useful to provide a service in more than one IP address
or sub-network, to facilitate the migration from a previous scenario or to have a web
server with different domains using SSL certificates.

.. figure:: images/intro/network_ifaces_static.png
   :scale: 50

   Static configuration of the network interface

.. figure:: images/intro/network_ifaces_pppoe.png
   :scale: 50

   PPPoE configuration of the network interface

If you connect the server to one or more VLAN networks, select
:guilabel:`Trunk (802.11q)`. Once selected, using this method you can create as
many interfaces associated to the defined *tag* as you wish and consider them as if
they were real interfaces.

. Once selected, using this method you can create as
many interfaces associated to the defined 

The VLAN network infrastructure allows you to segment the local network
to improve performance and security, without the need to invest in hardware
that would usually be necessary to create each segment.

.. figure:: images/intro/network_ifaces_vlan.png
   :scale: 50

   VLAN configuration of the network interface

The *bridged* mode consists of associating two physical network interfaces
attached to your server that are connected to two different networks. For example, one
card connected to the *router* and another card connected to the local network.
By using this association you can redirect the network traffic transparently
from one card to the other.

 mode consists of associating two physical network interfaces
card connected to the 

 and another card connected to the local network.

The main advantage here, is that client configurations do not need changing
when the Zentyal server gateway is deployed. Traffic that passes through the
server can be managed using content filtering or the intrusion detection
system.

You can create this association by changing the interface with
:guilabel:`Bridged network`. You can see how by choosing this option for a new
:guilabel:`Bridged network`. You can then choose the
group of interfaces you want to associate to this interface.

. You can then choose the

.. figure:: images/intro/network_ifaces_bridged.png
   :scale: 50

   Creation of a *bridge*

This will create a new virtual interface *bridge* which will have its own
configuration as well as a real interface and therefore, even the traffic
moves through in transparent mode, it can be used to offer other services such
as the administrative interface of Zentyal or a file server.

 which will have its own

.. figure:: images/intro/network_ifaces_bridgediface.png
   :scale: 50

   Configuration *bridged* interfaces

In case you need to configure the network interface manually, define
the gateway to Internet using :menuselection:`Network --> Gateways`. Normally this
is automatic if DHCP or PPPoE is in use, but not in all other cases.
For each gateway you can indicate the :guilabel:`Name`,
:guilabel:`IP address`, :guilabel:`Interface` to which it is connected. The
:guilabel:`Weight` defines the priority compared with other
*gateways* and whether it is :guilabel:`Predetermined` by all of them.

the gateway to Internet using 

. Normally this
For each gateway you can indicate the 

In addition, if an HTTP proxy is required for Internet access, you can
also configure this in this section. This proxy will be used by Zentyal for
connections, such as update and installation of packages or update of the
anti-virus data files.

.. figure:: images/intro/network_gateways.png
   :scale: 50

   Configuration of gateways

To allow the system to resolve domain names, you must indicate the
address of one or several name servers in :menuselection:`Network --> DNS`.

address of one or several name servers in 

.. figure:: images/intro/network_dns.png
   :scale: 50

   Configuration of DNS servers

If the Internet connection assigns a dynamic IP address and you need a domain
name to re-direct, you need a provider of dynamic DNS. By using
Zentyal you can configure some of the most popular providers of dynamic DNS.

To do this, you must select :menuselection:`Network --> DynDNS` where you can
choose the :guilabel:`Service` provider, :guilabel:`Username`, :guilabel:`Password`
and :guilabel:`Hostname` which needs updating when the public address changes.
Finally select :guilabel:`Enable dynamic DNS`.

 which needs updating when the public address changes.
Finally select 

.. figure:: images/intro/network_dyndns.png
   :scale: 50

   Configuration of Dynamic DNS

contar las ventajas del servicio de actualizaciones de listas de
seguridad de Zentyal

An **Intrusion Detection System (IDS)** [#]_ is an application designed to
detect unauthorised access, mainly attacks emanating from the *Internet*, to
your servers, computers and network.

Zentyal integrates Snort [#]_, one of the most popular IDS, available
for both Windows and Linux systems.

, one of the most popular IDS, available

For additional information about Snort, you're recommended to read the
official manual [#]_ as well as the Snort installation and
configuration guide for Ubuntu [#]_. Besides theses resources, you can read
the Ubuntu community documentation regarding the Snort installation and
configuration by using a terminal [#]_.

official manual 

 as well as the Snort installation and
configuration guide for Ubuntu 

. Besides theses resources, you can read
configuration by using a terminal 

An *IDS* captures all the traffic transferred by a network interface. It
then analyses the traffic against previously defined patterns or rules, comparing the normal
traffic with irregularities. These irregularities can be a sign of suspicious or malicious
activities or even attacks to your server or network. A typical example of the
suspicious data found by IDS are the first stages an of attack, such
as analysis of the network or port scanning.

 captures all the traffic transferred by a network interface. It

The two main functions of an IDS are to **detect** potential attacks and
intrusions. This is achieved by matching a set of rules against the inbound
traffic packets, and to **record** all suspicious events, keeping useful
information (such as IP address of the attacker) in a database or file.
Some IDS are combined with a firewall and are also capable of *blocking* the intrusion attempts.

 potential attacks and
traffic packets, and to 

 all suspicious events, keeping useful
Some IDS are combined with a firewall and are also capable of 

Due to the nature of Intrusion Detection System, a large amount of
resources are required because matches are continuously made against
known rules for each packet processed. This is especially true for
memory.

A well configured firewall that uses much fewer resources
is usually enough for most of scenarios. However, IDS is useful to maintain your
network in the most secure possible state, allowing you to detect attacks to services
that need to be exposed to the public. Potentially insecure networks
can be protected by IDS. Besides informing the systems administrator when malicious connections
are detected, so these attacks can be prevented, it can also
work as diagnostic tool in case an attack has already taken place.

memory.

 is an application designed to
detect unauthorised access, mainly attacks emanating from the 

Install the **zenmap** [#]_ package onto another machine.

Effect:
  The **zenmap** is installed to the selected system.

Enable the **IDS** module and launch a port scanning "attack" against the
Zentyal machine.

 module and launch a port scanning "attack" against the

Access Zentyal, go to :menuselection:`Module status` and enable the
:guilabel:`IDS` module by clicking on the corresponding box in the
:guilabel:`Status` column. You are informed that the Snort
configuration will be modified. Allow the operation by clicking on
:guilabel:`Accept`.

Effect:
  The :guilabel:`Save Changes` button is now enabled.

 column. You are informed that the Snort

Similarly, enable the :guilabel:`logs` module, if it was not already
enabled, then disable the :guilabel:`Firewall` module. For test purposes
the firewall should not block access to certain ports and services,
therefore preventing the analysis of traffic.

Effect:
  When the IDS is started it will be able to record events.

 module. For test purposes

Effect:
When the IDS is started it will be able to record events.

Go to the :menuselection:`IDS` menu and in the :guilabel:`Interfaces`
tab enable an interface that you can reach from the machine.
You will launch the attacks towards this interface.

Effect:
  The change has been temporarily saved, but it will not become effective
  until you have saved the changes.

Effect:
The change has been temporarily saved, but it will not become effective
until you have saved the changes.

Effect:
  From now on the IDS will analyse the traffic of the selected interface.

Effect:
From now on the IDS will analyse the traffic of the selected interface.

Run *zenmap* from the same machine. Once installed, you can find
the configuration options in :menuselection:`Applications --> Network --> Zenmap`.

Go to the IP of the Zentyal server in the field :guilabel:`Target` and
select the :guilabel:`Quick scan` profile in :guilabel:`Profile`.

Click on :guilabel:`Scan`.

Effect:

  Connection attempts to different Zentyal machine ports will be made.
  You can interrupt the process by clicking on :guilabel:`Cancel`.

 from the same machine. Once installed, you can find
the configuration options in 

Connection attempts to different Zentyal machine ports will be made.
You can interrupt the process by clicking on :guilabel:`Cancel`.

You can interrupt the process by clicking on 

Go to :menuselection:`Maintenance --> Logs --> Query Logs` and select
:menuselection:`Full report` for the :guilabel:`IDS` domain.

Effect:
  Entries related to the attack you have just carried out will be
  recorded in the table.

Effect:
Entries related to the attack you have just carried out will be
recorded in the table.

So far the basic operation of the IDS module has been described. This is not
very useful by itself because you will not be notified when the system detects intrusions
and security attacks against the network. As you are going to see, thanks to the
Zentyal logs and events system, this notification can be made simpler and more efficient.

The IDS module is integrated with the Zentyal logs module so if the latter is
enabled, you can query the different IDS alerts using the usual procedure.
Similarly, you can configure an event for any of these alerts to notify the
systems administrator.

Find out about other types of attacks and execute them against your
Zentyal machine to verify that the IDS is working properly,

Configure an events manager to notify you of possible intrusions
via Jabber or RSS.

Configuration of the Intrusion Detection System in Zentyal is very easy. You
only have to enable or disable a number of elements. First, you have to specify
which network interfaces you need IDS to listen on. After this,
you can choose different groups of rules that will matched to the captured
packets in order to obtain alerts, in case of positive results.

You can access both configuration options through the :menuselection:`IDS`
menu. In this section, on the :guilabel:`Interfaces` tab, a table with all the
configured network interfaces will appear. All of them are disabled by default
due to the increased network latency and CPU consumption caused by the
inspection of the traffic. However, you can enable any of them by clicking on
the checkbox.

 tab, a table with all the

.. figure:: images/ids/ids-01-interfaces.png
   :scale: 80

   Network interface configuration for IDS

If intrusion detection is only required on the gateway, you
only enable it for the external networks, but in some specific cases, you
can enable IDS for internal networks too. For example, if there are critical
services or you are interested in analysing the outgoing traffic.

In the :guilabel:`Rules` tab you have a table preloaded with all the Snort
rulesets installed on your system. A typical set of rules is enabled by
default.

 tab you have a table preloaded with all the Snort
default.

You can save CPU time disabling those rules you are not interested in, for
example, those related to services not available in your network. If you have
extra hardware resources you can also enable additional rules.

.. figure:: images/ids/ids-02-rules.png
   :scale: 80

   IDS rules

Spanish version uses PSI for windows, but this version uses it on Linux

**Instant messaging** [#]_ (or *IM* for short) is a mode of communication in real
time via text messages between two or more people. Messages are sent between
devices connected to the same network, such as the Internet.

Zentyal uses Jabber/XMPP as its IM protocol and **jabberd2** [#]_ XMPP server,
integrating network users with Jabber accounts.

If you are interested in learning more about Jabber/XMPP we recommend you
visit the web site of the *XMPP Standards Foundation* [#]_. This
foundation coordinates the efforts of the XMPP community to define
extensions to the XMPP protocol.

visit the web site of the 

. This

Besides the basic conversation between two users, IM has other features such as:

Status updates (i.e.: you are busy, on the phone, away or idle).

Simultaneous connection from devices with different priorities (e.g.: from
the mobile and the computer, giving preference to one of them for receiving
messages).

Nowadays, there are many instant messaging protocols such as
*ICQ*, *AIM*, *MSN* or *Yahoo! Messenger*, essentially proprietary and
centralised.

However, there is also Jabber/XMPP [#]_ which is a set of protocols and
technologies that enable the development of distributed messaging systems.
These protocols are public, open, flexible, extensible, distributed and secure.
Moreover, although Jabber/XMPP is still in the process of becoming an
international standard, it has been adopted by *Facebook*, *Cisco* or *Google*
(for its messaging service *Google Talk*) amongst others.

 which is a set of protocols and
international standard, it has been adopted by 

 for short) is a mode of communication in real

**Pidgin** [#]_ is a multi-protocol client that allows users to manage multiple
accounts at the same time. In addition to Jabber/XMPP, Pidgin supports many
other protocols such as IRC, ICQ, AIM, MSN and Yahoo!.

**Pidgin**, *the universal chat client* <http://www.pidgin.im/>.

Pidgin was included by default in the Ubuntu desktop edition until *Karmic*,
and it is the most popular IM client. In Ubuntu you can find
it in the :menuselection:`Internet --> Pidgin Internet Messenger` menu.
When starting Pidgin, if you do not have any account configured yet,
the window to manage accounts will appear as shown in the picture.

Pidgin was included by default in the Ubuntu desktop edition until 

,
it in the 

 menu.

.. figure:: images/jabber/pidgin1.png
   :scale: 60

   Window to manage accounts in Pidgin

From this window, you can add new accounts, modify and delete existing
accounts.

Clicking on :guilabel:`Add`, two tabs with the basic and advanced configuration
will appear.

, two tabs with the basic and advanced configuration

For the :guilabel:`Basic` configuration of your Jabber account, start by selecting
the protocol :guilabel:`XMPP`. The :guilabel:`Username` and :guilabel:`Password`
should be the same as the Jabber enabled user account has with Zentyal. The
:guilabel:`Domain` must be the same as the set up in the Jabber/XMPP Zentyal
module configuration. Optionally, in the field :guilabel:`Local alias`, write the name
you want to show to your contacts.

 configuration of your Jabber account, start by selecting
the protocol 

 must be the same as the set up in the Jabber/XMPP Zentyal
module configuration. Optionally, in the field 

.. figure:: images/jabber/pidgin2.png
   :scale: 60

   Add account in Pidgin - basic configuration

On the :guilabel:`Advanced` tab you can configure the SSL/TLS settings. By
default :guilabel:`Require SSL/TLS` is checked, so if you have disabled the
:guilabel:`SSL Support` on Zentyal you must uncheck it and check
:guilabel:`Allow plain text auth over unencrypted streams`.

.. figure:: images/jabber/pidgin3.png
   :scale: 60

   Add account in Pidgin - advanced configuration

If you did not change the default SSL certificate, a warning will be raised asking
whether you want to accept it.

.. figure:: images/jabber/pidgin4.png
   :scale: 60

   SSL certificate verification in Pidgin

 is a multi-protocol client that allows users to manage multiple

**Psi** [#]_ is a Jabber/XMPP client that allows users to manage multiple
accounts at the same time. Fast and lightweight, Psi is fully open-source
and compatible with Windows, Linux, and Mac OS X.

 is a Jabber/XMPP client that allows users to manage multiple

Jabber MUC or Multi User Chat is a service that allows multiple users exchange
messages in the context of a room. Features like room topics, invitations,
ability to kick and ban users, require password to join a room and many more
features are available in Jabber MUC rooms. For a full specification of MUC check the
document XEP-0045 [#]_ .

Once you have enabled :guilabel:`Enable Multi User Chat (MUC)` on the
:menuselection:`Jabber` Zentyal menu entry, further room configuration is
made using the Jabber client.

 Zentyal menu entry, further room configuration is

Everybody can create a room on the Jabber/XMPP Zentyal server and the user who
creates a room is the administrator for that room. This administrator can
modify all the settings, add other users as moderators or administrators
and destroy the room.

One of the settings that should be highlighted is :guilabel:`Make Room Persistent`.
By default all the rooms are destroyed shortly after the last participant leaves.
These are called dynamic rooms and are the preferred method for multi-user chats.
On the other hand, persistent rooms must be destroyed by one of their administrators and are
usually set up for work-groups or topics.

.

On Pidgin, to join a chat room go to :guilabel:`Buddies --> Join a Chat...`.
A :guilabel:`Join a Chat` window will pop up asking for some information like the
:guilabel:`Room` name, the :guilabel:`Server` which should be *conference.domain*,
the user :guilabel:`Handle` or nickname and the room :guilabel:`Password` if needed.

.. figure:: images/jabber/pidgin5.png
   :scale: 60

   Buddy list in Pidgin

.. figure:: images/jabber/pidgin6.png
   :scale: 60

   Join a chat with Pidgin

The first user to join a non existent room will lock it and will be asked whether to
:guilabel:`Configure Room` or just :guilabel:`Accept Defaults`.

.. figure:: images/jabber/pidgin7.png
   :scale: 60

   Create a new room with Pidgin

On :guilabel:`Room configuration` you can to set up all the parameters of the room.
This configuration window can be opened later by typing */config* in the room chat window.

 you can to set up all the parameters of the room.
This configuration window can be opened later by typing 

.. figure:: images/jabber/pidgin8.png
   :scale: 60

   Room configuration with Pidgin

Once configured, other users will be able to join the room under the applied settings, leaving
the room unlocked and ready to use.

.. figure:: images/jabber/pidgin9.png
   :scale: 60

   New room created with Pidgin

On Psi, to join a chat room you should go to :guilabel:`General --> Join Groupchat`.
A :guilabel:`Join Groupchat` window will pop up asking for some information like the
:guilabel:`Host` which should be the *conference.domain*, the :guilabel:`Room` name,
the user :guilabel:`Nickname` and the room :guilabel:`Password` if needed.

.. figure:: images/jabber/psi8.png
   :scale: 60

   Join a chat room with Psi

.. figure:: images/jabber/psi9.png
   :scale: 60

   Room data

The first user joining a non existent room will lock it and will be asked to
configure it. On the top right corner, a button will show a context menu with
the :guilabel:`Configure Room` option.

the 

.. figure:: images/jabber/psi10.png
   :scale: 60

   New room created with Psi

On :guilabel:`Room Configuration` you can to set up all the parameters of the room.

.. figure:: images/jabber/psi11.png
   :scale: 60

   Room configuration with Psi

images do not correspond between spanish and english versions. Please check

document XEP-0045 

**Psi**, *The Cross-Platform Jabber/XMPP Client For Power Users* <http://psi-im.org/>.

Enable the Jabber/XMPP service and assign a domain name that Zentyal and the
clients are able to resolve.

Access Zentyal, go to :menuselection:`Module Status` and enable
the :guilabel:`Jabber` module. When information about the required system actions
is displayed, allow these by clicking :guilabel:`Accept`.

Effect:
  The button :guilabel:`Save Changes` has been enabled.

 module. When information about the required system actions
is displayed, allow these by clicking 

Add a domain with the desired name and which IP address is the
Zentyal server, in the same way as in *practical examples* in *DNS* section.

Effect:
  You will be able to use the added domain as the domain for your Jabber/XMPP
  service.

Zentyal server, in the same way as in 

Effect:
You will be able to use the added domain as the domain for your Jabber/XMPP
service.

service.

Access the :menuselection:`Jabber` menu. In the field
:guilabel:`Domain Name`, write the domain name you just added. Click on
:guilabel:`Apply Changes`.

Effect:

Effect:
  Now the Jabber/XMPP service is ready to be used.

Enable the Jabber account for a Zentyal user and check that it is possible to
launch your session in the server. Double check that you are using the Zentyal IP
address as the primary DNS to be able to resolve the domain correctly.

Add a colleague as a friend and check you are able to communicate with him.
If your server is connected to the global Jabber network,
check it with an external account too.

Repeat what you have done in the former exercises, but using SSL.
Set :guilabel:`SSL Support` to *Mandatory* and check what are the required
changes in the configuration of the client to be able to connect.

Set 

 and check what are the required

Enable the support for multi-user chat rooms and connect to the room with
several accounts. For this, in Pidgin go to
:menuselection:`Friends --> Join a chat...`. The first person
to join the room is in charge of creating and configuring it.

. The first person

To configure the Jabber/XMPP server in Zentyal, first check the :guilabel:`Module Status`
and that the :guilabel:`Users and Groups` module is enabled - Jabber depends
on this. Then, mark the :guilabel:`Jabber` checkbox to enable the Jabber/XMPP Zentyal module.

To configure the Jabber/XMPP server in Zentyal, first check the 

To configure the service, go to :menuselection:`Jabber` in the left hand menu,
and set the following parameters:

.. figure:: images/jabber/jabber.png
   :scale: 80

   General Jabber Configuration

:guilabel:`Jabber Domain`:
Used for specifying the domain name of the server. User accounts will be *user@domain*.

Used for specifying the domain name of the server. User accounts will be 

*domain* should have an entry in the DNS server, so it can be
resolved from the clients.

 should have an entry in the DNS server, so it can be

:guilabel:`SSL Support`:
It specifies whether the communications (authentication and chat messages) with
the server are encrypted or plain text. You can disable it, make it mandatory or leave
it as optional. If you set it as optional, this setting will be selected from the
Jabber client.

:guilabel:`Connect to other servers`:
If you want to allow your users to contact other users on external servers,
or the other way around, check this box. Otherwise, if you want a private
server for your internal network, leave it unchecked.

:guilabel:`Enable MUC (Multi User Chat)`:
Enables conference rooms (chat with more than two users).

The conference rooms are under the domain *conference.domain* which, like the
:guilabel:`Jabber Domain`, should have an entry in the DNS server, so it can be
resolved from the clients too.

, should have an entry in the DNS server, so it can be

To create a Jabber/XMPP user account, go to :menuselection:`Users --> Add User`
if you want to create a new user account, or to
:menuselection:`Users --> Edit User` if you just want to enable the Jabber
account for an existing user.

 if you just want to enable the Jabber

.. figure:: images/jabber/jabber-account.png
   :scale: 80

   Setting up a Jabber account

As you can see, a section called *Jabber account* will appear, where you can
select whether the account is enabled or disabled. Moreover, you can specify
whether the user will have administrator privileges. Administrator privileges
allow you to see which users are connected to the server, send them messages, set
the message displayed when connecting (*MOTD*, Message Of The Day) and send a
notice to all connected users (broadcast).

 will appear, where you can
the message displayed when connecting (

, Message Of The Day) and send a

The configuration of a Jabber client is described in this chapter using **Pidgin**
and **Psi**, but if you use a different client, the steps are very similar.

The configuration of a Jabber client is described in this chapter using 

, but if you use a different client, the steps are very similar.

When starting Psi, if you do not have an account configured yet, a window will
appear asking whether to use an existing account or register a new one, as shown
in the picture. You will select :guilabel:`Use existing account`.

in the picture. You will select 

.. figure:: images/jabber/psi1.png
   :scale: 60

   Account setup on Psi

On the :guilabel:`Account` tab you will set up the basic configuration like the
:guilabel:`Jabber ID` or JID which is *user@domain* and the :guilabel:`Password`.
The user and password should be same as the Jabber enabled user account on Zentyal.
The domain must be the same as the one set up on the Jabber/XMPP Zentyal module configuration.

.

.. figure:: images/jabber/psi2.png
   :scale: 60

   Psi account properties

On the :guilabel:`Connection` tab you can find the SSL/TLS settings among other
advanced configuration options. By default :guilabel:`Encrypt connection: When available`
is selected. If you have disabled the :guilabel:`SSL Support` on Zentyal you must change
:guilabel:`Allow plaintext authentication` to :guilabel:`Always`.

 tab you can find the SSL/TLS settings among other
advanced configuration options. By default 

.. figure:: images/jabber/psi3.png
   :scale: 60

   Connection properties on Psi

whether you want to accept it. To avoid this message check :guilabel:`Ignore SSL
warnings` on the :guilabel:`Connection` tab from last step.

whether you want to accept it. To avoid this message check 

.. figure:: images/jabber/psi4.png
   :scale: 60

   SSL certificate warning on Psi

The first time you connect the client it will raise a harmless error because you
have not published your personal information on the server yet.

.. figure:: images/jabber/psi5.png
   :scale: 60

   Error message the first time Psi connects

Optionally you can publish some information about yourself here.

.. figure:: images/jabber/psi6.png
   :scale: 60

   Personal information on Psi

.. figure:: images/jabber/psi7.png
   :scale: 60

   Successful Psi connection

Screenshot de la configuración del correo externo en el user corner

POP3 (*Post Office Protocol version 3*) [#]_:
This is one of the most commonly used protocols and it is supported by a large number
of clients and servers. Basically it defines the mechanisms for obtaining
and deleting messages stored on a remote server. It is oriented to the
local management of mail, while the server just keeps mail until the client
requests it. It uses port 110, and 995 for secure connections over SSL.

For sending/receiving mails Zentyal uses **Postfix** [#]_ as SMTP server.
For the mail reception service (POP3, IMAP) Zentyal uses **Dovecot** [#]_. Both come with
support for secure communication over SSL. To fetch mail from
external accounts, Zentyal uses **Fetchmail** [#]_ .

 as SMTP server.
For the mail reception service (POP3, IMAP) Zentyal uses 

. Both come with
external accounts, Zentyal uses 

**Dovecot** *Secure IMAP and POP3 Server* http://www.dovecot.org .

If you are interested in learning more about the mail protocols discussed so far
it is recommended you read information from the links in this section.

If you want to learn how to configure a mail server using Linux command line
it is recommended to read the Ubuntu Server community documentation [#]_.

it is recommended to read the Ubuntu Server community documentation 

The electronic mail service, or **e-mail**, is a network service
which allows users to send or receive messages, with or without
digital documents attached. Thanks to its convenience and low
cost, e-mail has become a major means of communication between Internet users.

, is a network service

Originally, the email was sent directly from one computer to another,
requiring that both were running at the same time to send the message.
In fact, the email service is older than the Internet itself, and it was deployed
in the very first computer networks. Current e-mail systems store
their content temporarily on servers which forward it to clients when they
connect.

E-mails are exchanged using **SMTP** (Simple Mail Transfer Protocol).
There are many e-mail client programs available on all operating systems,
such as Thunderbird or Outlook.

 (Simple Mail Transfer Protocol).

As this communication system is so widespread it has been exploited by
certain groups and individuals to spread malicious software. Means of
infecting computers includes viruses, worms or spam (junk mail, containing
unwanted advertising or scams).

Zentyal uses several open source mail services including **Postfix**, **Dovecot**
and **Fetchmail**; these will be discussed later, along with references to the
homepages of the projects.

; these will be discussed later, along with references to the

There are several types of mail servers, depending on the protocol used.
The most popular are:

In this chapter these protocols, and the software implementing
them, will be described in detail.

The following diagram depicts a typical event sequence that takes place when
*Alice* writes a message using her e-mail client or **Mail User Agent** (MUA)
to reach the e-mail address of the recipient, *Bob*

.. figure:: images/mail/mail-ab.png
   :scale: 60
   :alt: Diagram where Alice sends an e-mail to Bob

   Diagram where Alice sends an e-mail to Bob

Her MUA formats the message and uses the
Simple Mail Transfer Protocol (SMTP) to send the message to the
local Mail Transfer Agent (MTA).

The MTA looks at the destination address provided in SMTP,
in this case *bob@b.org*, and requests the domain name service
to determine the IP of the
destination mail server (**MX record** or Mail eXchanger record [#]_).

in this case 

, and requests the domain name service
destination mail server (

The *smtp.a.org* server sends the message to *mx.b.org* using SMTP, which
delivers it to the mailbox of the user *bob*.

Bob receives the message through his MUA, which picks up the
message using *Pop Office Protocol* (POP3).

message using 

There are many alternative possibilities to the
previous sequence. For instance, Bob can use a different protocol to
pick up his/her e-mail, for example, the *Internet Message Access
Protocol* (IMAP), which would allow him to read the message directly from
the server, or by using a **Webmail** service such as those provided by
several free services on the Internet.

pick up his/her e-mail, for example, the 

 (IMAP), which would allow him to read the message directly from
the server, or by using a 

 service such as those provided by

Therefore, the sending and reception of e-mails between mail servers is
achieved through SMTP, but users pick up their e-mail using POP3, IMAP or the
corresponding secure versions (POP3S and IMAPS). These protocols provide interoperability
among different servers and e-mail clients. There are also proprietary
protocols such as the ones used by *Microsoft Exchange* and *IBM Lotus Notes*.

protocols such as the ones used by 

The design of POP3 means that retrieval of e-mail messages allows users to pick up their
e-mail all at once and to read and manage it later on without needing to be
connected. This is particularly good when Internet connections are slow.
Messages are usually removed from the user mailbox on the server,
although most MUAs allow users to keep e-mails on the server.

On the other hand, the more modern IMAP, allows you to work on-line or offline and it
also gives you the ability to explicitly delete messages stored on the server. Additionally, it supports
simultaneous access by multiple clients to the same mailbox or partial retrievals
from MIME messages - amongst other advantages. However, it is quite a complicated
protocol that requires more server work load than POP3; where most of the load
is on the client side. The main advantages of IMAP over POP3 are:

Message status information using *flags* (read, removed, replied, ...).

Multiple mailboxes on the server (usually presented to the user as
folders) allowing users to make some of them public.

IMAP (*Internet Message Access Protocol*) [#]_:
This protocol is also widely supported by e-mail clients, but not so much on
servers. Unlike POP3, it is designed to allow remote management of
mailboxes. IMAP is far more complex than POP, allowing not only
services for download, but also deletion. However, it keeps the mail status
allowing multiple mailboxes per user. Multiple clients can all manage the
same mailbox simultaneously. IMAP uses port 143, and secure versions of IMAPS and
IMAP4 over SSL use the ports 585 and 993 respectively.

SMTP (*Simple Mail Transfer Protocol*) [#]_:
The previously discussed protocols were responsible for connecting clients
with the servers hosting e-mails, i.e. the reception and management of e-mails.
SMTP is the protocol responsible for delivering mail to servers and
between servers. It is almost the only protocol used for this task and one of the oldest
still in use. SMTP uses port 25 and the secure version, working over SSL, uses port 465.

Finally, the mail server can be configured to use a content filter for
messages [#]_. To do so, the filter server must receive the
message from a specific port and send the result back to another port
where the mail server is bound to listen to the response.  You can choose a custom
mailfilter or use Zentyal as a mail filter through :menuselection:`Mail --> General --> Mail filter options`.
If the **mailfilter** module is installed and enabled, it will be used by default.

You can manage the authentication options
Through :menuselection:`Mail --> General --> Mail server options --> Authentication`.

:menuselection:`Mail --> General --> Mail server options --> Authentication`

:guilabel:`TLS for SMTP server`:
This forces the clients to connect to the mail server using TLS encryption,
thus avoiding eavesdropping.

:guilabel:`Require authentication`:
This setting enables the use of authentication. A user must provide an
e-mail address and a password to identify; once authenticated,
the user can relay mail through the server. An account alias can not be
used to authenticate.

.. figure:: images/mail/01-general.png
   :scale: 80
   :alt: Mail general configuration

   General Mail configuration

In the :menuselection:`Mail --> General --> Mail server options -->
Options` section you can configure the general settings for the mail
service:

:menuselection:`Mail --> General --> Mail server options -->
Options`

 section you can configure the general settings for the mail
service:

:guilabel:`Smarthost to send mail`:
Domain name or IP address of the smarthost. You could also specify a
port appending the text `:[port_number]` after the address. The
default port is the standard SMTP port, 25.

If this option is set, Zentyal will not send its messages directly, but
each received e-mail will be forwarded to the *smarthost* without
keeping a copy. In this case, Zentyal is an intermediary between
the user who sends the e-mail and the server that actually sends the message.

port appending the text 

 after the address. The

each received e-mail will be forwarded to the 

 without

:guilabel:`Smarthost authentication`:
This sets whether the smarthost requires authentication using a user and
password pair, or not.

:guilabel:`Server mailname`:
This sets the visible mail name of the system; it will be used by the mail
server as the local address of the system.

:guilabel:`Postmaster address`:
The postmaster address by default is an alias of the root user,
but it could be set to any account; either belonging to any of the managed
virtual mail domains or not.

This account is intended to be a standard way to reach the
administrator of the mail server. Automatically-generated
notification mails will typically use *postmaster* as reply
address.

address.

notification mails will typically use 

:guilabel:`Maximum mailbox size allowed`:
Using this option you could indicate a maximum size in MB for any
user's mailboxes. All mail that exceeds the limit will be rejected
and the sender will receive a notification. This setting could be
overridden for any user in the :menuselection:`Users and Groups -->
Users` page.

overridden for any user in the 

:guilabel:`Maximum message size accepted`:
It indicates, if necessary, the maximum message size accepted by the
smarthost in MB. This is enforced regardless of any user mailbox size limit.

:guilabel:`Expiration period for deleted mails`:
If you enable this option, those mail messages which are in the
users' trash folder will be deleted when their dates exceeds the established limit.

:guilabel:`Expiration period for spam mails`:
This option applies, in the same way as the previous option, but refers to
the users' spam folder.

When configuring an e-mail server, it is very important to set the
server's *hostname* correctly. It must be a FQDN (Fully Qualified Domain
Name), i.e., a complete domain name, such as *foo.example.com*.
If it is not set properly, it is likely many e-mail servers will reject
your e-mails. This is because they will not be able to contact the sender in case of error when
delivering e-mail to a mailbox.

server's 

 correctly. It must be a FQDN (Fully Qualified Domain
Name), i.e., a complete domain name, such as 

.

To configure the mail retrieval services go to the
:guilabel:`Mail retrieval services` section. Here, Zentyal can be
configured as POP3 and/or IMAP server, together with the corresponding secure
versions; POP3S and IMAPS. Also, allowing the retrieval of e-mail for external
accounts and ManageSieve services can be enabled in this section, which
will be explained in the :ref:`fetchmail-sec-ref` section.

 section. Here, Zentyal can be
will be explained in the 

In order to configure the mail retrieval services go to the
:guilabel:`Mail retrieval services` section. There Zentyal can be
configured as POP3 and/or IMAP server, together with the secure
versions POP3S and IMAPS.

 section. There Zentyal can be

In addition to this, Zentyal can be configured to relay mail without
authentication from some network addresses. To do this, you can add
relay policies for Zentyal network objects through :menuselection:`Mail -->
General --> Relay policy for network objects`. The policies are based
on the source mail client IP address. If relay is allowed by an
object, then each object member can relay e-mails through Zentyal.

relay policies for Zentyal network objects through 

:menuselection:`Mail -->
General --> Relay policy for network objects`

. The policies are based

.. figure:: images/mail/02-relay.png
   :scale: 80
   :alt: Relay policy for network objects

   Relay policy for network objects

Be careful when using an *Open Relay* policy, i.e. forwarding
e-mail from everywhere, since your mail server will probably
become a spam source.

 policy, i.e. forwarding

This topic is deeply explained in the :ref:`mailfilter-sec-ref` section.

.. figure:: images/mail/mailfilter-options.png

   Mailfilter options

messages 

. To do so, the filter server must receive the
mailfilter or use Zentyal as a mail filter through 

You could configure Zentyal to retrieve e-mail messages from external
accounts, which are stored on external servers, and deliver them to
the user's mailboxes. To configure this you have to enable
this service in :menuselection:`Mail --> General --> Mail server
options --> Retrieval services` section. Once it is enabled, the users
will have their mail fetched from their external accounts and
delivered to their internal account's mailbox. Each user can configure
his/her external accounts through the :ref:`usercorner-ref` [#]_. The user must
have an e-mail account to be able to do this. The external servers are pooled
periodically so e-mail retrieval is not instantaneous.

this service in 

:menuselection:`Mail --> General --> Mail server
options --> Retrieval services`

 section. Once it is enabled, the users
his/her external accounts through the 

. The user must

The **Sieve language** [#]_ allows the user to control how the mail
messages are delivered, so that it is possible to classify the mail in IMAP
folders, forward it or use a vacation message among other things.

The **ManageSieve** is a network protocol that allows the users to
easily manage their Sieve scripts. To be able to use ManageSieve,
an e-mail client that understands this protocol is required . [#]_

 is a network protocol that allows the users to
an e-mail client that understands this protocol is required . 

To enable ManageSieve in Zentyal you have to enable the service in
:menuselection:`Mail --> General --> Mail server options -> Retrieval
services` and it can be used by any user with an e-mail account. In
addition to this, if ManageSieve is enabled and the **webmail** [#]_ module is in
use, a management interface for Sieve scripts will be available in the
webmail interface.

services`

 and it can be used by any user with an e-mail account. In
addition to this, if ManageSieve is enabled and the 

 module is in

The ManageSieve authentication is achieved by using the user's e-mail account and
password.

Sieve scripts for an account are executed regardless of whether ManageSieve
is enabled or not.

 allows the user to control how the mail

The user corner settings is explained in :ref:`usercorner-ref` section.

Set up a virtual domain for the e-mail service. Create a user account
and an e-mail account within the domain for that user. Configure the
relay policy to send e-mail messages. Send a test e-mail message
with the new account to an external e-mail account.

Enter Zentyal, go to :menuselection:`Module status` and enable
*Mail* by marking the checkbox in the :guilabel:`Status` column.
Enable *Network* and *Users and Groups* first if they
are not enabled already.

Effect:
  Zentyal requests permission to overwrite certain files and perform
  some actions.

Effect:
Zentyal requests permission to overwrite certain files and perform
some actions.

Read the changes that will be made in the files to be modified and
grant Zentyal permission to overwrite them.

Effect:
  The :guilabel:`Save changes` button is now enabled.

Go to :menuselection:`Mail --> Virtual Domains` and click
:guilabel:`Add new` to create a new domain. Enter the name in
the appropriate field and click the :guilabel:`Add` button.

Effect:
  Zentyal notifies the user that changes must be saved to use this virtual
  domain.

 to create a new domain. Enter the name in
the appropriate field and click the 

Effect:
Zentyal notifies the user that changes must be saved to use this virtual
domain.

domain.

Effect:
  Now you can use the newly created virtual mail domain.

Go to :menuselection:`Users and Groups --> Users --> Add User`,
fill up the user data and click the :guilabel:`Create and Edit` button.

Effect:
  The user is added immediately without saving changes. The edition
  screen is displayed for the newly created user.

Effect:
The user is added immediately without saving changes. The edition
screen is displayed for the newly created user.

This action is only required if you have disabled the automatic
creation of e-mail accounts in `Users and Groups --> Default User
Template --> Mail Account`: enter a name for the user e-mail account
in :guilabel:`Create mail account` and create it by clicking the
:guilabel:`Create` button.

Effect:
  The account has been immediately added and options to delete it
  or add *aliases* for the account are shown.

creation of e-mail accounts in 

Effect:
The account has been immediately added and options to delete it
or add *aliases* for the account are shown.

or add 

Go to the :menuselection:`Network --> Object --> Add new` menu. Fill in a name for
the object and press :guilabel:`Add`. Click on :guilabel:`Members`
in the created object. Again fill in a name for the member and write
the host IP address where the e-mail will be sent from and click on the
:guilabel:`Add` button.

Effect:
  The object has been added temporarily and you can use it in other
  sections of Zentyal. This change is not permanent until you save changes.

Effect:
The object has been added temporarily and you can use it in other
sections of Zentyal. This change is not permanent until you save changes.

Go to :menuselection:`Mail --> General --> Relay policy for network
objects`. Select the previously created object making sure that
:guilabel:`Allow relay` is checked and click on the :guilabel:`Add`
button.

Effect:
  The :guilabel:`Save changes` button has been enabled.

button.

:menuselection:`Mail --> General --> Relay policy for network
objects`

Effect:
  A relay policy for that object has been added, which allows
  to send e-mails to outside from that object.

Effect:
A relay policy for that object has been added, which allows
to send e-mails to outside from that object.

Configure a selected e-mail client in order to use Zentyal as
the SMTP server and send a test e-mail message from this new
account to an external one.

Effect:
  After a brief period of time you should receive the message in your
  external account mailbox.

Effect:
After a brief period of time you should receive the message in your
external account mailbox.

Send an e-mail using the e-mail account created above, setting
the same address as recipient. Check that the e-mail message can be
retrieved using POP3. Also configure it to use *Secure POP* to
enhance retrieval security.

retrieved using POP3. Also configure it to use 

Configure the SMTP service to use authentication and TLS. Send an e-mail
message using the same user as above to an external e-mail account using
the password and TLS.

Enable IMAP to access mailboxes and check if it works properly. Now
configure it to use *Secure IMAP* to improve retrieval security.

configure it to use 

Send a message whose recipient is ``root@hostname`` substituting
*hostname* by the real configured host name. Verify that the
message is shown in the pending messages queue.

 by the real configured host name. Verify that the

Set up a virtual mail domain alias and an alias for the user's e-mail
account. Send an e-mail message whose recipient is that alias with
that domain and make sure the message is received correctly.

To connect to ManageSieve, you will need the following parameters:

Port:
4190; beware that some applications mistakenly use port
number 2000 as default for ManageSieve.

Username:
Full e-mail address; as mentioned before, avoid using the username or any
of the e-mail address aliases.

Password:
User's password. Some clients allows you to select the same
authentication than your IMAP or POP3 account; if this is allowed,
select it.

select it.

A **catch-all account** is an account which receives a copy of all
the mail sent and received by a mail domain. Zentyal allows you to
define a catch-all account for every virtual domain. To define it
you must go to :menuselection:`Mail --> Virtual domains` and
then click in the :guilabel:`Settings` cell.

 is an account which receives a copy of all
you must go to 

All the messages sent and received by the domain will be e-mailed as
**Blind Carbon Copy** (BCC) to the defined address. If the mail to the
catch-all address bounces, it will be returned to the sender.

 (BCC) to the defined address. If the mail to the

Unless users access their e-mail exclusively through the webmail or the
groupware application, users should configure their
e-mail clients to use Zentyal's mail server. The values of the required
parameters would depend on the exact configuration of the module.

Please note that different e-mail clients could use different names for
these parameters, so, due to the great number of available clients, this
section is merely provides guidance.

SMTP server:
Enter the address of your Zentyal server. It could be
either an IP address or a domain name.

Secure connection:
Select `TLS` if you have enabled :guilabel:`TLS for SMTP
server`; otherwise select `none`. If you are using TLS please read
below the warning about SSL/TLS.

. If you are using TLS please read

SMTP username:
For the username you should use the full e-mail address of the user; you
should not enter simply the user name or any of the e-mail aliases.
This option is only required if you have enabled the
:guilabel:`Require authentication` parameter, which is the usual case.

You can only use POP3 settings when POP3 or POP3S services are enabled
in Zentyal.

POP3 server:
Enter your Zentyal server address, as for the SMTP parameters section
above.

above.

Select `SSL` if you are using POP3S, `none` if you are using POP3.
If you are using POP3S please read the warning about SSL/TLS.

 if you are using POP3.

POP3 username:
Full e-mail address; you should not enter just the user name or any
of the e-mail aliases.

IMAP configuration can be used only if either IMAP or IMAPS services are
enabled.

IMAP server:
Enter your Zentyal server address like in the SMTP parameters section
above.

above.

Select `SSL` if you are using IMAPS, `none` if you are using IMAP.
If you are using IMAPS please read the warning below about SSL/TLS.

 if you are using IMAP.

IMAP username:

In client implementations there is some confusion about the use of
SSL and TLS protocols. Some clients use `SSL`; this means that they will
try to connect with `TLS`; others use `TLS` as a way to say that
they will try to connect to the secure service through a port
normally used by the plain version of the protocol. In fact, in some
clients you will need to try both `SSL` and `TLS` modes to find out
which one works.

You have more information about this issue on the Dovecot wiki
http://wiki.dovecot.org/SSL .

SSL and TLS protocols. Some clients use 

 as a way to say that
clients you will need to try both 

Now you will see how these parameters are applied in a real world scenario; for this you
will set up an e-mail client, in this case **Microsoft Outlook**.

will set up an e-mail client, in this case 

In order to configure Outlook, go to :menuselection:`Tools --> Accounts`.
You will see a window with several tabs; select the :guilabel:`Mail` tab.

.. figure:: images/mail/mail-windows1.png
   :scale: 60

   Account settings

Click on :guilabel:`Add` and select :guilabel:`Mail` and add your name.

.. figure:: images/mail/mail-windows2.png
   :scale: 60

   Account name

In the next step you have to enter the e-mail address to which
you want to connect the client.

.. figure:: images/mail/mail-windows3.png
   :scale: 60

   E-mail address

In the next step you will have to enter the server address for
incoming and outgoing mail. For incoming mail you can configure
three protocols: POP3, IMAP and HTTP.

.. figure:: images/mail/mail-windows4.png
   :scale: 60

   E-mail server addresses

Once you have entered the server data, click on :guilabel:`Next`
and you will see a section to configure the user specifying the
account name and the password.

.. figure:: images/mail/mail-windows5.png
   :scale: 60

   User configuration

Once this step is completed, you will see a final confirmation window;
after accepting the changes, the new e-mail account should appear in the
list of accounts.

.. figure:: images/mail/mail-windows6.png
   :scale: 60

   End of configuration wizard

You will now see the same example in Ubuntu; setting Thunderbird. The
account settings are in the :menuselection:`File --> New --> Mail account...`
menu. A window will appear asking for the following parameters:
:guilabel:`Name`, :guilabel:`e-mail address` and :guilabel:`Password`.

account settings are in the 

.. figure:: images/mail/mail-ubuntu1.png
   :scale: 60

   Account name and basic data

Once you have entered these values, Thunderbird tries to set the rest of the mail client parameters.
If you want to add the settings manually, you can click the
:guilabel:`Manual configuration...` button. This opens a window where you can
enter the values directly.

 button. This opens a window where you can

.. figure:: images/mail/mail-ubuntu2.png
   :scale: 60

   Settings autodetection

The values of incoming mail can be set in the :guilabel:`Server settings` section,
where you can set the server name and port, user name, the connection security
(none, STARTTLS or SSL/TLS) and whether to use secure authentication.

 section,

.. figure:: images/mail/mail-ubuntu3.png
   :scale: 60

   Incoming server settings

Outgoing mail can be set in the :guilabel:`Outgoing server (SMTP)` section.

.. figure:: images/mail/mail-ubuntu4.png
   :scale: 60

   Outgoing servers

You can select the account you want to configure and click on :guilabel:`Edit...`.
This opens a window where you can set several parameters, such as the server name
and port, whether to use a password and whether the connection has to be secure.

.

.. figure:: images/mail/mail-ubuntu5.png
   :scale: 60

   Outgoing server settings

Once you have at least one configured virtual mail domain, you will find new panels under
:guilabel:`Users and Groups` that will assist you managing the email accounts of your
users.

 that will assist you managing the email accounts of your
users.

Using the configured virtual domain, a mail account will be automatically created for the new users,
following the format *user@ourdomain*. You can also change the type of quota (custom, default or
no quota) and configure the maximum size of the mailbox for the custom quota.

following the format 

. You can also change the type of quota (custom, default or

.. figure:: images/mail/useraddonen.png
    :align: center
    :scale: 80

    Automatic mail configuration for new users

Users that pre-date the virtual mail domain will not get an associated mail account
automatically.

You frequently want a formal mail address for external communications, i.e. johnsullivan@mycompany.com
and alias with nicknames or short versions for convenience, i.e. john@mycompany.com or
johnny@mycompany.com. To cover this case, you have the :guilabel:`Create mail aliases`
option, where you can add any number of alternative names. Of course, all the emails sent to any of these
addresses will reach the same inbox, without any extra configuration by the receiver.

You frequently want a formal mail address for external communications, i.e. 

and alias with nicknames or short versions for convenience, i.e. 

Another interesting add-on of the mail system can be found in :menuselection:`Users and Groups --> Groups -> Edit
desired group`, where you can configure a mail alias for the group, in other words, an address to
broadcast a message to all the members of this group. You just have to choose a name and click the 'add'
icon.

:menuselection:`Users and Groups --> Groups -> Edit
desired group`

, where you can configure a mail alias for the group, in other words, an address to
icon.

.. figure:: images/mail/groupaddonen.png
    :scale: 80

    Adding a mail alias for the group

From :menuselection:`Mail --> Queue Management`, you can see those
e-mail messages that haven't been delivered yet, together with all the
information about each message. The allowed actions to
perform are: deletion, content viewing or retry sending (*re-queueing*
the message again). There are also two buttons to delete or re-queue
all messages in queue.

, you can see those
perform are: deletion, content viewing or retry sending (

.. figure:: images/mail/04-queue.png
   :scale: 80

   Queue management

To understand the mail system configuration, the difference
between receiving mail and relaying mail must be made clear.

**Reception** occurs when the server accepts a mail message which
recipients contain an account that belongs to any of its virtual mail
domains. Mail can be received from any client that is able to
connect to the server.

 occurs when the server accepts a mail message which

**Relay** occurs when the mail server receives a
message which recipients do not belong to any of its managed virtual
mail domains, thus requiring forwarding of the message to other servers.
Mail relay is restricted, otherwise *spammers* could use the server to
send spam all over the Internet.

 occurs when the mail server receives a
Mail relay is restricted, otherwise 

A source address that belongs to a network object which has a
**allowed relay** policy enabled.

To set up an e-mail account, a virtual domain and
a user are required. You can create as many virtual domains as you want
from :menuselection:`Mail --> Virtual Domains`. They provide the
*domain name* for e-mail accounts of Zentyal users. Moreover, it is
possible to set *aliases* for a virtual domain, so that sending an e-mail to a
particular virtual domain or to any of its aliases becomes transparent.

from 

 for e-mail accounts of Zentyal users. Moreover, it is
possible to set 

 for a virtual domain, so that sending an e-mail to a

.. figure:: images/mail/mail-vdomains.png
   :scale: 80
   :alt: Virtual mail domains

   Virtual mail domains

In order to set up e-mail accounts, you have to follow the same rules
used when configuring filesharing. You can select the main virtual domain for the user
from :menuselection:`Users and Groups --> Users --> Edit Users --> Create
mail account`.
You can create aliases if you want to set more than a single e-mail
address for a user. Regardless of whether aliases have been used, the e-mail
messages are kept just once in a mailbox. However, it is not possible
to use the alias to authenticate, you always have to use the real
account.

from 

:menuselection:`Users and Groups --> Users --> Edit Users --> Create
mail account`

.
account.

.. figure:: images/mail/03-user.png
   :scale: 80
   :alt: Mail settings for a user

   Mail settings for a user

Note that you can decide whether an e-mail account should be created by
default when a new user is added to Zentyal. You can change this behaviour in
:menuselection:`Users and Groups --> Default User Template --> Mail Account`.

:menuselection:`Users and Groups --> Default User Template --> Mail Account`

Likewise, you can set up *aliases* for user groups. Messages received
by these aliases are sent to every user of the group with an e-mail
account. Group aliases are created through :menuselection:`Users and
Groups --> Groups --> Create alias mail account to group`. The group aliases
are only available when, at least, one user of the group has an e-mail
account.

 for user groups. Messages received
account. Group aliases are created through 

Groups --> Groups --> Create alias mail account to group`

. The group aliases
account.

You can define an alias to an external account as well. The mail sent to
that alias will be forwarded to the external account. These kind of
aliases are set on a virtual domain basis and do not require an
e-mail account. They can be set in :menuselection:`Mail --> Virtual
Domains --> External accounts aliases`.

e-mail account. They can be set in 

:menuselection:`Mail --> Virtual
Domains --> External accounts aliases`

To configure his/her external accounts, a user must login in the
:menuselection:`User corner` and click on
:menuselection:`Mail retrieval from external mail accounts` in the left
menu. In this page a list of user's external accounts is shown and the user can
add, edit and delete accounts. Each account has the following fields:

 in the left

:guilabel:`External account`:
The username or the mail address required
to login in to the external mail retrieval service.

Password to authenticate the external account.

:guilabel:`Mail server`:
Address of the mail server which hosts the external account.

:guilabel:`Protocol`:
Mail retrieval protocol used by the external account; it can be one of
the following: POP3, POP3S, IMAP or IMAPS.

Port used to connect to the external mail server.

.. figure:: images/mail/usercorner-external-mail.png
   :scale: 80

   User corner settings for external accounts

The **grey lists** [#]_ exploit the expected performance of mail servers
dedicated to *spam*. The behaviour is matched and all mail from the servers is discarded or
not, hindering the spamming process.

These servers are optimised to send as many emails as possible in minimal time.
For this, messages are auto-generated and sent without caring if they are
received. When you have a **grey list** system, the emails considered as
potential *spam* are rejected and the mail server is asked to send the email
again. If the server is actually a *spammer* server, it probably doesn't have
the necessary tools to manage this request and therefore the email will never
reach the recipient. On the contrary, if the email was legitimate, the sending
server will simply re-send mail.

received. When you have a 

 are rejected and the mail server is asked to send the email
again. If the server is actually a 

 server, it probably doesn't have

Zentyal uses **postgrey** (http://postgrey.schweikert.ch/) as a
**postfix** policy manager.

The Zentyal strategy is to pretend to be out of service.
When a new server sends an email, Zentyal responds "*I am temporarily out of
service, try again in 300 seconds.*" [#]_. If the sending server complies
with the request, it will re-send the email after this time and Zentyal will
mark it as a valid server.

When a new server sends an email, Zentyal responds "

. If the sending server complies

Zentyal does not include email sent from internal networks on the gray list,
or from objects with an allowed email relay policy or from addresses that are in the
*antispam* whitelist.

Actually the mail server responds "Greylisted", i.e. moved to the
grey list and pending to allow or disallow the mailing once the configured
time has passed.

.. figure:: images/mailfilter/greylisting-schema.png
   :scale: 80
   :alt: Schema on how the grey list works

   Schema on how the grey list works

The *Grey list* can be configured via :menuselection:`Mail --> Grey list`
with the following values:

.. figure:: images/mailfilter/05-greylist.png
   :scale: 70

   Grey list configuration

:guilabel:`Grey list duration (seconds)`:
Seconds the sending server must wait before re-sending the email.

:guilabel:`Retry window (hours)`:
Time in hours in which the sending server can send mail. If the
server receives any mail during this time, this server will go to
the grey list. In a grey list the server can send all the emails it
wishes with no time restrictions.

:guilabel:`Entry time-to-live (days)`:
Days the data of the evaluated servers will be stored in the grey list.
After the configured days, when the server sends email again, it must go
through the *greylisting* process described above.

through the 

. The behaviour is matched and all mail from the servers is discarded or

The mail content filtering is processed by the **antivirus** and **spam**
detectors. To carry out this task, Zentyal uses an interface between the MTA
[#]_ and these applications. Therefore, the **amavisd-new** [#]_ application
is used to ensure that the email is not spam and it does not contain viruses.

MTA: *Mail Transfer Agent*, software that transfers the emails,
**postfix** in case of Zentyal.

 application

Zentyal uses the **ClamAV** [#]_ antivirus, an antivirus toolkit
especially designed to scan email attachments in a MTA. **ClamAV** uses
database updater that allows the programmed updates and digital signatures
via the **freshclam** program. Furthermore, the *antivirus* is capable of native
scanning of a number of file formats, such as Zip, BinHex, PDF and so on.

In :menuselection:`Antivirus` you can check if
the system's *antivirus* is installed and updated.

.. figure:: images/mailfilter/11-antivirus.png
   :scale: 80
   :alt: Antivirus message

   Antivirus message

You can update it from :menuselection:`Software Management`, as you will
see in :ref:`software-ref`.

It is optional to install the antivirus module, but if you do install it,
you can see that it integrates several other Zentyal modules. This integration
increases the security of the configuration options of different services, such as
the SMTP filter, POP *proxy*, HTTP *proxy* or file sharing.

the SMTP filter, POP 

 antivirus, an antivirus toolkit
especially designed to scan email attachments in a MTA. 

 uses
via the 

 is capable of native

The *antispam* filter gives each email a *spam* score and if the
email reaches the *spam* threshold it is considered junk mail. If
not, it is considered as legitimate email. The latter kind of email is
often called *ham*.

 threshold it is considered junk mail. If
often called 

The spam scanner uses the following techniques to assign scores:

Of all these techniques, the **Bayesian filter** will be explained in
more detail. This type of filter ensures statistical analysis of the
text of the message, giving it a score that reflects the likelihood
of the message being *spam*. However, the analysis is not based on a
set of static rules, but on dynamic rules that are created by
supplying the filter *ham* and *spam* messages. This allows the filter to
learn the statistical features of each type of message.

 will be explained in
of the message being 

. However, the analysis is not based on a
supplying the filter 

 messages. This allows the filter to

The advantage of this technique is that the filter can adapt to the
ever-changing flow of *spam*. The downside is that the filter needs
to be trained and its accuracy depends on the quality of the received
training messages.

ever-changing flow of 

. The downside is that the filter needs

You can find a long list of *antispam* techniques at
http://en.wikipedia.org/wiki/Anti-spam_techniques_(e-mail)

The Powerful #1 Open-Source Spam Filter
http://spamassassin.apache.org .

The general configuration of the filter is done from
:menuselection:`Mail filter --> Antispam`:

.. figure:: images/mailfilter/12-antispam.png
   :scale: 80

   Antispam configuration

:guilabel:`Spam threshold`:
Mail will be considered spam if the score is above this value.

:guilabel:`Spam subject tag`:
Tag to add to the mail subject in case it is spam.

:guilabel:`Use Bayesian classifier`:
If marked, Bayesian filter will be used. Otherwise it will be ignored

:guilabel:`Auto-whitelist`:
Considers the account history of the sending server when giving the
score to the message; if the sender has sent plenty of *ham* emails, it
is highly probable that the next email will be *ham* and not *spam*.

score to the message; if the sender has sent plenty of 

:guilabel:`Auto-learn`:
If marked, the filter will learn from the received messages, which score
passes the auto-learn thresholds.

:guilabel:`Autolearn spam threshold`:
Filter will learn that email is *spam* if the score is above this value.
You should not set a low value, since it may cause false positives. The
value must be greater than the spam threshold.

 if the score is above this value.

:guilabel:`Autolearn ham threshold`:
Filter will learn that email is *ham* if the score is below this value.
You should not set a high value, since it may cause false negatives. The
value must be less than 0.

 if the score is below this value.

From :guilabel:`Sender Policy` you can configure senders whose emails
are always accepted (*whitelist*), always marked as spam (*blacklist*)
or always processed by the antispam filter (*process*)

From :guilabel:`Train Bayesian spam filter` you can train the
Bayesian filter by sending it a mailbox in *Mbox* [#]_ format,
containing only *spam* or *ham*. You can find many sample files from
the Internet to train the Bayesian filter, but usually you get more
accurate results if you use email received in the sites you need to
protect. The more trained the filter is, the better results you get
when testing if a message is junk or not.

. You can find many sample files from

*Mbox* and *maildir* are email storage formats, independent of the
the used email client. For Mbox, all the emails are stored in
a single file, whilst maildir organises emails into separate
files within a directory.

 are email storage formats, independent of the

Filters based on the message *checksum*, checking emails that are
identical, but with some few changes.

, checking emails that are

Bayesian filter, a statistical algorithm that learns from its past mistakes
when classifying an email as *spam* or *ham*.

when classifying an email as 

If Zentyal is configured as a **transparent proxy**, it can filter POP
email. The Zentyal host will be placed between the real POP server and the
email (MTA). To do this, Zentyal uses **p3scan** [#]_.

You can configure the connections from external MTAs using their IP addresses
from :menuselection:`Mail filter --> SMTP mail filter --> External connections`
or domain name forwarding towards the mail filter configured using Zentyal. In the same
way, you can allow these external MTAs to filter mail from those virtual
domains, that have been allowed, external to Zentyal.
This way, Zentyal can distribute the load between two hosts, one acting as a
mail server and another as the server for mail filtering.

from 

:menuselection:`Mail filter --> SMTP mail filter --> External connections`

.. figure:: images/mailfilter/13-external.png
   :scale: 80

   External mail servers

From :menuselection:`Mail filter --> Transparent POP proxy` you can configure
the behaviour of the filtering.

.. figure:: images/mailfilter/10-filter-pop.png

   POP transparent proxy configuration

:guilabel:`Filter virus`:
If checked, POP email will be filtered and set to detect viruses.

:guilabel:`Filter spam`:
If checked, POP email will be filtered and set to to detect spam.

:guilabel:`ISP spam subject`:
If the server marks the *spam* with a header, add it
here so that the server notifies the filter that all the emails with
this header can be considered *spam*.

 with a header, add it
this header can be considered 

, it can filter POP
email (MTA). To do this, Zentyal uses 

Enable the mail filter and antivirus. Send an email with a virus.
Check that the filter is working properly.

:guilabel:`mail filter` module by checking the corresponding box in
the :guilabel:`Status` module. Enable the modules network
and firewall first, if they are not enabled yet.

Effect:

 module. Enable the modules network

Study the changes that will be made in the files that will be modified
and grant Zentyal permission to overwrite them.

Effect:

Go to :menuselection:`Mail filter --> SMTP mail filter`,
check the :guilabel:`Enabled` box and
:guilabel:`Antivirus enabled` then click on the button
:guilabel:`Change`.

Effect:
  Zentyal notifies you that the options have been successfully modified
  with the "Done" message.

Effect:
Zentyal notifies you that the options have been successfully modified
with the "Done" message.

Go to :menuselection:`Mail --> General --> Mail filter options`
and select :guilabel:`Zentyal internal mail filter`.

Effect:
  Zentyal will use its own filter system.

Effect:
  The mail filter has been enabled with the antivirus option.

Effect:
The mail filter has been enabled with the antivirus option.

Download the file http://www.eicar.org/download/eicar_com.zip that
contains a test virus and send it from your email client to one of the
Zentyal email accounts.

If you try to download the infected file through a HTTP proxy with antivirus,
it is possible that the access is denied. In this case, disable the HTTP
proxy antivirus temporarily.

Effect:
  The email will never reach its destination because the antivirus has
  discarded it.

 that

Effect:
The email will never reach its destination because the antivirus has
discarded it.

Enable the *spam filter*. Send an email and once received, check that it
includes the **spamassassin** headers.

Add an address to the *spammers* blacklist. Send and email from that address
and check whether you receive it.

 blacklist. Send and email from that address

Enable the *ham* (`ham@domain.tld`) account for one of the
virtual domains created earlier then send a valid email to this mailbox. Later, resend
the email to a local address of the mail server and check that it has been
marked as *ham*.

) account for one of the
marked as 

Enable the greylisting, try to send an email from an external
address to a mailbox of the server and notice how the email has been
delayed. Try resending the email when the waiting time is over.

Set a host in an internal network to use Zentyal as gateway with a POP
client. Enable the transparent *proxy POP* module. Check that the headers of
new email received through the proxy include **p3scan**.

client. Enable the transparent 

 module. Check that the headers of
new email received through the proxy include 

Deny the sending and delivery of those emails that contain an attached
file compressed using the LZW (Lempel-Ziv-Welch) algorithm.

You can filter the files attached to the mails by using
:menuselection:`Mail filter --> Files ACL` (*File Access Control
Lists*).

Here, you can allow or deny mail according to the extensions of the
attached files or their MIME types.

.. figure:: images/mailfilter/06-filter-files.png
   :scale: 80

   Attached file filter

From :menuselection:`Mail filter --> SMTP mail filter` you can configure
the behaviour of the described filters, when Zentyal receives mail by SMTP.
From :menuselection:`General` you can configure the general behaviour of
all incoming mail:

 you can configure
From 

.. figure:: images/mailfilter/07-filter-smtp.png
   :scale: 80
   :alt: General parameters for the SMTP filter

   General parameters for the SMTP filter

:guilabel:`Antivirus enabled`:
Check to ensure the filter searches for viruses.

:guilabel:`Antispam enabled`:
Check to ensure the filter searches for *spam*.

:guilabel:`Notify of non-spam problematic messages`:
You can send notifications to a mailbox when you receive
problematic emails that aren't spam, for example, emails
infected by a virus.

From :menuselection:`Filter policies` you can configure how the filter
must act with different types of emails.

 you can configure how the filter

.. figure:: images/mailfilter/08-filter-smtp-policies.png
   :scale: 80
   :alt: SMTP filter policies

   SMTP filter policies

:guilabel:`Pass`:
Do nothing, let the email reach its recipient.

:guilabel:`Reject`:
Discard the message before it reaches the recipient, notifying the
sender that the message has been rejected.

:guilabel:`Bounce`:
Like *Reject*, but enclosing a copy of the message in the notification.

:guilabel:`Discard`
Discard the message before it reaches the recipient, without notifying the
sender.

sender.

From :menuselection:`Virtual domains` you can configure the behaviour
of the filter for virtual domains of the email server. These settings
override the previously defined default settings.

 you can configure the behaviour

To customise the configuration of a virtual domain of the email, click
on :guilabel:`Add new`.

on 

.. figure:: images/mailfilter/09-filter-domains.png
   :scale: 80
   :alt: Filter parameters per virtual domain of the mail

   Filter parameters per virtual domain of the mail

:guilabel:`Domain`:
Virtual domain you want to customise. Those configured in
:menuselection:`Mail --> Virtual domain` are available.

:guilabel:`Use virus / spam filtering`:
If enabled, the email received in this domain will be filtered in search of
viruses or *spam*

viruses or 

You can use the default score for spam or custom value.

:guilabel:`Learn from the spam IMAP folders of the accounts`:
If enabled, when emails are taken to the spam folder the filter learns them
and records spam. Also, if you move a message from the spam folder to a regular
folder, the filter records *ham*.

folder, the filter records 

:guilabel:`Ham / spam learning account`:
If enabled, `ham@domain` and `spam@domain` accounts will be created. The
users can send emails to these accounts and train the filter. All the email
sent to `ham@domain` will be recorded as not *spam* whilst the email sent to
`spam@domain` will be recorded as *spam*.

 accounts will be created. The
sent to 

Once you have added the domain, you can add addresses to your
whitelist, blacklist or force the processing from
:menuselection:`Antispam policy for senders`.

**Spam**, or unwanted email, distracts the user and wastes users time
as they have to search for legitimate emails in the inbox. Moreover, spam generates a large
amount of traffic that can affect the normal operation of the network and mail
services, not to mention the potential risk of fraud to your users.

, or unwanted email, distracts the user and wastes users time

Although the **virus** will not affect the system on which Zentyal is installed, an
email containing a virus can infect other client hosts on the network.
Other risks include malicious attackers, who may try to obtain privileges on your
machines and use them for other purposes.

 will not affect the system on which Zentyal is installed, an

Zentyal offers a powerful and flexible mail filter to defend your network
and users from these threats.

.. figure:: images/mailfilter/mailfilter-schema.png
   :scale: 80
   :alt: Mail filter schema in Zentyal

   Mail filter schema in Zentyal

In the figure, you can see the different steps an e-mail passes through before being
tagged as valid or not. First, the email server sends it to the greylisting
policies manager and if considered as potential spam, the system requests that the
email is forwarded to the source server. If the email passes through this
filter, it will move to the mail filter. This will use a statistical filter to
check a series of email features to discover whether it contains virus or is
junk mail. If the email passes through all the filters, it is considered valid and
it is sent to the recipient or stored on the server's mailbox.

In this section the details of each filter and how to configure
them in Zentyal will be explained step by step.

You may buy **Zentyal VoIP credit** in Zentyal store_ if you have
*Professional* or *Enterprise Server Subscription*.

Zentyal VoIP module allows you to easily manage an *Asterisk* server with the users that
already exist on the system's LDAP server, and to configure the most common features.

 server with the users that

.. figure:: images/voip/deployment.png
   :scale: 50

   Basic diagram of how VoIP works

As usual, the module must be enabled first. Go to :menuselection:`Module Status`
and select the :guilabel:`VoIP` checkbox. The :guilabel:`Users and groups`
should be enabled beforehand.

.. figure:: images/voip/ebox-asterisk_general.png
   :scale: 50

   VoIP configuration window in Zentyal

To change the general configuration, go to :menuselection:`VoIP --> General`.
Once there, the following general parameters should be configured:

.

:guilabel:`Enable demo extensions`:
This enables the extensions 400, 500 and 600. A call to extension 400 starts music on hold
if configured. Extension 500 starts an IAX call
to guest@pbx.digium.com. Extension 600 provides an echo test to estimate your
call latency. These extensions can help to check if a client is well
configured.

to 

. Extension 600 provides an echo test to estimate your

:guilabel:`Enable outgoing calls`:
This enables outgoing calls through a
SIP provider to call regular phones. To call through the SIP provider, add an
additional zero before the number to call. For instance, to call Zentyal
offices (+34 976733506 or 0034976733506) dial 00034976733506.

:guilabel:`Voicemail extension`:
This is the extension to call to check voicemail. User and password are
the extension assigned by Zentyal when you create the user or assign it for the first
time. It is strongly recommended that the password is changed immediately from
**User Corner** [#]_. The application listening on this extension allows you
to change the welcome message, listen to recorded messages and delete them.
For security reasons, it is only accessible to the users of the Zentyal server,
so it does not accept incoming calls from other servers.

. The application listening on this extension allows you

*User corner* is explained in the :ref:`usercorner-ref` section.

:guilabel:`VoIP domain`:
This is the domain assigned to the user addresses. For example, a user *user* with an
extension 1122 can be called at user@domain.tld or at 1122@domain.tld.

This is the domain assigned to the user addresses. For example, a user 

In the :guilabel:`SIP provider` section, enter the credentials supplied by the
SIP provider, so that Zentyal can route calls through it:

 section, enter the credentials supplied by the

The user name used to log into the provider service.

The password to log into the provider service.

:guilabel:`Recipient of incoming calls`:
The internal extension that will receive the incoming calls to the
provider account.

The :guilabel:`NAT configuration` section defines the network location of
your Zentyal host. If it has a public IP address, the default option
:guilabel:`Zentyal is behind NAT: No` is correct. If it has a private IP
address, you must provide *Asterisk* with your *Internet* public IP address. If you
have a fixed public address, select :guilabel:`Fixed IP address` and enter it;
if the IP is dynamic, you must configure the dynamic DNS service (Dynamic DNS) available in
:menuselection:`Network --> Dynamic DNS` (or configure it manually) and enter the
domain name in :guilabel:`Dynamic hostname`.

 section defines the network location of

 and enter it;

In the :guilabel:`Local networks` section, you can add the local networks to
which Zentyal has direct access without NAT, like VPN or network segments
not configured from Zentyal, like a wireless network. This is required due to
SIP behaviour in NAT environments.

 section, you can add the local networks to

To configure the authentication of the VoIP phones, go to
:menuselection:`VoIP --> Phones`

.. figure:: images/voip/phones.png
   :scale: 80

   Adding a VoIP phone

Whether this phone configuration is enabled.

Needed to authenticate the phone against Zentyal, it will have to be configured
in the phone itself as well.

:guilabel:`Voicemail`:
The device available through this extension will store the voicemail for this phone.

:guilabel:`Email notified`:
This email address will receive the voicemail messages as an attachment.

You can access the conference configuration through
:menuselection:`VoIP --> Meetings`. Here you can configure multiple conference
rooms. These rooms :guilabel:`extension` should fit in the 8001-8999 range and
optionally have an :guilabel:`access password`, an :guilabel:`administration password`
and a :guilabel:`description`. These
extensions can be accessed from any server by dialling extension@domain.tld.

. Here you can configure multiple conference
rooms. These rooms 

.. figure:: images/voip/ebox-asterisk_meetings.png
   :scale: 80

   List of meetings

When you edit a user, you will be able to enable and disable this user's VoIP
account and change his/her extension. Take into account that an extension can only
be assigned to one user and no more, if you need to call more
than one user from an extension, you must use queues.

.. figure:: images/voip/ebox-asterisk_user.png
   :scale: 80

   Managing the VoIP per user

When editing a group, you can enable and disable
group's queue. A queue is an extension and when a call is made to a queue,
all the users who belong to this queue will receive the same call.

.. figure:: images/voip/ebox-asterisk_group.png
   :scale: 80

   Managing the VoIP queues per group

If you want to configure music on hold, drop the songs
in MP3 format to :file:`/var/lib/asterisk/mohmp3/` and install the
package *mpg123*.

in MP3 format to 

**Voice over IP** or **VoIP** [#]_ involves transmitting voice over data networks
using different protocols designed to send the digital signal through packets instead
of using analog circuits.

 involves transmitting voice over data networks

Any IP network can be used for this purpose, including private or
public networks such as the *Internet*. There are huge cost savings to be
made when using the same network for data and voice - without losing quality or
reliability. The main issues found in VoIP deployments over data networks
are **NAT** [#]_ and the difficulties that protocols have in handling this,
**QoS** [#]_, because of the need to offer a high quality real-time service,
where latency (the time it takes for data to arrive at destination),
**jitter** [#]_ (variations on latency) and bandwidth need to be taken into
consideration.

public networks such as the 

. There are huge cost savings to be
are 

, because of the need to offer a high quality real-time service,

 (variations on latency) and bandwidth need to be taken into

**SIP** (*Session Initiation Protocol*) is a protocol created by the IETF [#]_
for the establishment, modification and termination of interactive multimedia
sessions. It incorporates many elements of HTTP and SMTP. SIP only handles
signalling and works over the UDP/5060 port. Multimedia transmission is handled
by RTP over the port range UDP/10000-20000.

There are several protocols involved in voice transmission, from network
protocols like IP and transport protocols like TCP or UDP, to voice
protocols both for signalling and transport.

VoIP **signalling protocols** accomplish the task of establishing and controlling
the call. SIP, IAX2 and H.323 are signalling protocols.

 accomplish the task of establishing and controlling

The most widely used **voice transport protocol** is RTP
(*Realtime Transport Protocol*), which carries the encoded voice from origin to
destination. This protocol starts once the call has been established by the signalling
protocol.

), which carries the encoded voice from origin to
protocol.

**IAX2** is the second version of the *Inter Asterisk eXchange* protocol,
created for connecting *Asterisk* PBX systems. The main feature of this
protocol is that voice and signalling travel through the same data stream, which
is called **trunking**, and it can be encrypted. This way data can traverse NAT
easily and there is less overhead
when trying to keep multiple communication channels open among servers.
IAX2 works on UDP/4569 port.

 PBX systems. The main feature of this
is called 

, and it can be encrypted. This way data can traverse NAT

**H.323** is a protocol for audio-visual communications designed to run on any
packet network. It was originally developed for videoconferencing applications
over LANs, but it was finally adopted by the industry for a variety of solutions
on different IP networks, including WANs and the Internet. Its greatest strength
lies in being a veteran protocol containing a complete and well-proven set of
standards that are not limited to controlling the signal, but they also define
the additional services expected in business communication solutions.

 is a protocol for audio-visual communications designed to run on any

**Internet Engineering Task Force** develops and promotes communication
standards used on Internet.

 develops and promotes communication

Zentyal uses **Asterisk** [#]_ to implement the VoIP module. *Asterisk* is a software
only application that works on any commodity server, providing the features of a
PBX (*Private Branch eXchange*) to connect multiple phones, using a
VoIP provider or the analog telephone network. It also offers services such
as voice mail, conferences, interactive voice responses and so on.

 is a software
PBX (

) to connect multiple phones, using a

There are plenty of resources available on the Internet describing the configuration of
*Asterisk* and *VoIP*. As a first reference, it is recommended to
directly access the *Asterisk* web site [#]_. You can also find more documentation on
*Asterisk* at the Asterisk documentation project [#]_. Finally, you can find
a collection of several free utilities for *Asterisk* with which to complete
the functionality of your PBX [#]_.

To connect the *Asterisk* server to the analog telephone network, you need extra
cards called FXO (*Foreign eXchange Office*) which allow *Asterisk* to act like a
regular phone and route calls through the phone network. To connect an analog
phone to the server, you need a FXS (*Foreign eXchange Station*) card. This way,
existing phones can be adapted to the new IP telephony network.

 server to the analog telephone network, you need extra
cards called FXO (

 to act like a
phone to the server, you need a FXS (

) card. This way,

.. figure:: images/voip/tdm422e.png
   :scale: 80

   Digium TDM422E FXO and FXS card

. As a first reference, it is recommended to
directly access the 

. Finally, you can find
a collection of several free utilities for 

**Ekiga** [#]_ is the *softphone* (or VoIP client) recommended for the Gnome
desktop environment. When first launched, Ekiga presents a wizard to configure
the user's personal data, audio and video devices, the connection to the
Internet and the *Ekiga.net*'s services. You can skip the configuration of both
*Ekiga.net* and *Ekiga Call Out*.

**Qutecom** [#]_ is a softphone based on multiplatform technologies, making it
available for the three most popular operating systems: Windows, Mac and Linux.
When launched for the first time it displays a wizard to configure the VoIP
account, as does Ekiga.

 is a softphone based on multiplatform technologies, making it

.. figure:: images/voip/qutecom_01.png
   :scale: 50

   Qutecom configuration window

You have a keypad or a list of contacts to make calls. Use the green/red buttons
at the bottom to call and hang up.

.. figure:: images/voip/qutecom_02.png
   :scale: 50

   Main Qutecom window

From :guilabel:`Edit --> Accounts`, selecting :guilabel:`Accounts
--> Add a SIP Account` you can configure your VoIP account in Zentyal.

.. figure:: images/voip/ekiga_01.png
   :scale: 80

   Window to register a new account

:guilabel:`Register server`:
Domain name of the Zentyal VoIP server.

:guilabel:`User` and :guilabel:`User for authentication`:
Zentyal user name.

After setting up the account, it will try to register to the server.

.. figure:: images/voip/ekiga_02.png
   :scale: 50

   List of created accounts

Making a call is as simple as typing the number or SIP address
on the top bar, and using the green phone icon in the right bar.
To hang up, use the red phone icon.

.. figure:: images/voip/ekiga_03.png
   :scale: 50

   Main Ekiga window

 (or VoIP client) recommended for the Gnome
Internet and the 

Create a user with a VoIP account. Change the extension to 1500.

Access Zentyal, click on :menuselection:`Module status` and
enable the :guilabel:`VoIP` module by clicking the checkbox in the
:guilabel:`Status` column. If :guilabel:`Users and Groups` is not enabled
you should enable it before. Zentyal will inform you about the changes
that are going to take place in the system. You should allow these actions
by clicking the :guilabel:`Accept` button.

Effect:
  The :guilabel:`Save Changes` button has been enabled.

 is not enabled
by clicking the 

Go to the :menuselection:`VoIP` module. Write the host's domain name in
:guilabel:`VoIP Domain`. The domain should be resolvable from the
service clients. Click on :guilabel:`Change`.

. The domain should be resolvable from the
service clients. Click on 

Effect:
  VoIP service is now ready to be used.

Access the :menuselection:`Users and Groups --> Users --> Add User` menu.
Fill in the form to create a new user. Click on :guilabel:`Create and Edit`.

Effect:
  Zentyal creates a new user and displays his/her profile with the available options.

Effect:
Zentyal creates a new user and displays his/her profile with the available options.

In the :guilabel:`VoIP Account` section, Zentyal displays whether the user
account is enabled or disabled, and also the extension.
Make sure that the account is enabled; all the users created while
the VoIP module is enabled should also have the VoIP account enabled. Finally,
change the extension given by default, which is the first free extension,
to the extension 1500.
Click on the :guilabel:`Apply changes` button in the :guilabel:`VoIP Account` section.

Effect:
  Zentyal applies the changes immediately. The user is able to receive calls in
  that extension.

 section, Zentyal displays whether the user
Click on the 

Effect:
Zentyal applies the changes immediately. The user is able to receive calls in
that extension.

Create a user with a VoIP account. Configure this user account for
one of the softphones mentioned previously. Enable the test extension
and verify that it works correctly.

Create a VoIP account for another user. Close the softphone
configured previously and set up this new user using another VoIP client,
Call the first user just created and leave a message
in the voice mailbox. Close the current softphone again and, by using
the previous softphone, check the voice mail of the user you just called.

Create a conference room in one of the allowed extensions and invite someone to
join and test it.

The **call transferring** feature is quite simple. While you are in a
conversation, press :kbd:`#` and then dial the extension where you need to
transfer the current call. You can hang up afterwards as the call will be
ringing on the called extension.

 feature is quite simple. While you are in a
conversation, press 

 and then dial the extension where you need to

**Call parking** works on the extension 700. Whilst you are in a conversation,
press :kbd:`#` to initiate a transfer, then dial 700. The extension the call has been
parked to will be announced to the called person. The caller will listen to
call hold music, if configured. You can hang up now. From a different phone or a different
user, the called person or group will dial the announced extension and the parked user will
receive a wake up, and the call can start.

 works on the extension 700. Whilst you are in a conversation,
press 

 to initiate a transfer, then dial 700. The extension the call has been

On Zentyal, the call parking can hold up to 20 concurrent calls and the maximum time
a call can be parked is 300 seconds.

Phones with a traditional look but with a RJ45 connector to plug
them into an *Ethernet* data network instead of the typical RJ11 connector
used by analog telephone networks. They also add new features like an address book or call
automation - not present in regular analog phones.

them into an 

 data network instead of the typical RJ11 connector

.. figure:: images/voip/phone1.jpg
   :scale: 50

.. figure:: images/voip/phone2.jpg
   :scale: 50

   IP Phones

**Softphones** are computer programs used to make and receive calls without
additional hardware other than the computer's microphone and speakers. There are
multiple applications for all platforms and operating systems. X-Lite and
QuteCom (WengoPhone) are available for Windows, Mac and Linux. Ekiga is the
VoIP client for Ubuntu, but also compatible for Windows. Twinkle is only
available for Linux.

 are computer programs used to make and receive calls without

.. figure:: images/voip/qutecom.png
   :scale: 40

   QuteCom

.. figure:: images/voip/twinkle.png
   :scale: 40

   Twinkle

In contrast to traditional telephone, which routes all calls through a central
PBX, VoIP clients (IP phones or softphones) register with the server, ask for
the call recipient information and then establish the call directly. When establishing
the call, the caller and the recipient negotiate a common codec for the voice
transmission. The server acts mainly as a directory, leaving the communication to
happen directly between the clients if the network allows this.

Analog adaptors, also known as **ATA** (*Analog Telephony Adapter*), can
connect a traditional analog phone to a data network and make it work like
an IP phone. They have an RJ45 data port and one or more RJ11 analog ports.

), can

.. figure:: images/voip/ata.jpg
   :scale: 40

   Analog Adapter

A **codec** is an algorithm that adapts digital information (encoding at origin
and decoding at destination) for compression, reducing bandwidth usage, detecting
and recovering from transmission errors. G.711, G.729, GSM and speex are
common codecs for VoIP.

 is an algorithm that adapts digital information (encoding at origin

**G.711**:
This is one of the most widely used codecs. It comes in two flavors: an
American one (*ulaw*) and an European one (*alaw*). This codec offers good
quality, but it has significant bandwidth requirements (64kbps), which makes it
a common choice for communication over local networks.

American one (

). This codec offers good

**G.729**:
Offers a better compression using only 8kbps, being ideal for
Internet communications. There are some usage restrictions on this
codec, such as switchboards, as it has some problems with the fax transmission, *DTMF* tones
and high quality audio.

codec, such as switchboards, as it has some problems with the fax transmission, 

**GSM**:
This is the same codec that is used in mobile networks. Voice quality is
not very good and it uses around 13kbps.

**speex**:
A patent-free codec especially designed for voice. It is very
versatile, though it uses more CPU time than others. It can work at different
bit rates, such as 8KHz, 16KHz and 32KHz, usually referred as *narrowband*,
*wideband* and *ultra-wideband*, each consuming 15.2kbps, 28kbps and 36kbps
respectively.

bit rates, such as 8KHz, 16KHz and 32KHz, usually referred as 

As previously explained, many protocols are involved in this type of
communication (audio codecs, RTP over UDP, UDP over IP ...).
This fact, together with the large number of packets that are sent to request a
service with real-time quality, causes an **overload** by
the heads of each of these packages that can possibly exceed the bandwidth consumed
by the data itself. That is, it is easy to reach a situation in which
control traffic surpasses data traffic, making the bandwidth consumption
far from efficient. To minimise the impact of this problem, the protocols
used in VoIP apply mechanisms such as stopping sending packets during
silence. Others make use of the packages for sending not only data, but also
control information for signalling protocols.

service with real-time quality, causes an 

 by

Rebrandeado del diagrama de road warriors, poner nombres naturales a
los clientes (comercial, gerente...), cambiar WAN por Internet

The **virtual private networks** [#]_ were designed to allow secure access for
remote users connected via the Internet to the corporate network - as well as
securely connect different subnets via the Internet.

Zentyal integrates OpenVPN [#]_ PPTP and IPsec to configure and manage virtual private
networks. In this section you will see how to configure OpenVPN, the default VPN protocol in Zentyal.
In the following section you will find out how to configure PPTP and IPsec.

 PPTP and IPsec to configure and manage virtual private

Easier to install, configure and maintain than IPSec, another
open source VPN alternative.

Often the resources needed by your users are available in your network, but
not to the users based outside the company premises. However, they need these resources,
in the typical case of sales people or teleworkers. The solution is to allow
these users to connect to your system via the Internet, although this might
mean risking the confidentiality, availability and integrity of the
communication. To avoid these problems, the connection is not made directly,
but through virtual private networks.

The solution, virtual private network or VPN, is the use of encryption
to only allow access to authorised users.
In addition, to simplify general use and configuration, the connections
appear as if they were within the same network. This allows them to use of all the
resources and settings made by the system administrator for the local
network - saving time.

The usefulness of the VPN is not limited to remote access by
users; an organisation may wish to interconnect networks located in
different places, such as offices in different cities.

Similarly, Zentyal can be used in two modes, as a server for individual
users and also as a connection between two or more networks managed by
Zentyal.

During this course you will learn about the VPN server operating mode for individual
user connections. Using Zentyal for connections between networks is left for more
advanced courses.

 were designed to allow secure access for

You now have access to the data server from both remote clients. If you want to
use the local Zentyal DNS service through the private network, you need to
configure these clients to use Zentyal as name server. Otherwise, it will not be
possible to access services by the hosts in the LAN by name, but only by IP
address. Also, to browse shared files from the VPN [#]_ you must explicitly
allow the broadcast of traffic from the Samba server.

address. Also, to browse shared files from the VPN 

 you must explicitly

For additional information about file sharing go to section
:ref:`filesharing-chapter-ref`

The goal of this exercise is to connect two networks that use Zentyal servers
as a gateway towards the external network, allowing the members of both networks to
connect to each other.

Access the Zentyal web interface that will take the role of the tunnel
server. Make sure that the **VPN** module is enabled and enable it if
necessary. At the :menuselection:`VPN --> Servers` section create a new server
using the following configuration parameters:

   * :guilabel:`Port`: choose a port that is not in use, such as 7766.
   * :guilabel:`VPN address`: enter a private network address that is not in
     use anywhere else in your infrastructure, for example 192.168.20.0/24.
   * Enable the :guilabel:`Allow Zentyal-to-Zentyal tunnels`. This is the
     option that enforces a tunnel server.
   * Enter a :guilabel:`Password for Zentyal-to-Zentyal tunnels`.
   * Finally, at :guilabel:`Interfaces where the server is listening`,
     choose an external interface to connect to the Zentyal client.

To complete the server configuration, you must advertise networks,
following the same steps as in the previous examples. Advertise the
private network to which the client needs access. It is
convenient to remember that this step is not necessary on
the client. The client will provide all its routes automatically to the
server. All you have to do is to enable the service and save the changes.

Effect:
  Once you have carried out all the previous steps, you have a VPN server
  running and its status can be checked using the :menuselection:`Dashboard`.

server. Make sure that the 

 section create a new server

:guilabel:`Port`: choose a port that is not in use, such as 7766.

:guilabel:`VPN address`: enter a private network address that is not in
use anywhere else in your infrastructure, for example 192.168.20.0/24.

: enter a private network address that is not in

Enable the :guilabel:`Allow Zentyal-to-Zentyal tunnels`. This is the
option that enforces a tunnel server.

Finally, at :guilabel:`Interfaces where the server is listening`,
choose an external interface to connect to the Zentyal client.

,

Effect:
Once you have carried out all the previous steps, you have a VPN server
running and its status can be checked using the :menuselection:`Dashboard`.

running and its status can be checked using the 

To make the configuration process of the client easier, get a client
configuration *bundle* by downloading it from the server. To download it
go to the Zentyal *Web* interface and in the
:menuselection:`VPN --> Servers`, click on the
:guilabel:`Download client configuration bundle`. Before
you can download the *bundle* you must establish few parameters in the
download form:

   * :guilabel:`Type of client`: choose *Zentyal-to-Zentyal tunnel*.
   * :guilabel:`Client certificate`: choose a certificate that isn't the
     certificate of the server nor is used by any other client. If you don't have
     enough certificates, follow the steps of the earlier exercises to create a
     certificate the client can use.
   * :guilabel:`Server address`: enter an address the client can use
     to connect to the server, in this scenario the correct address is the address of
     the external interface connected to the visible network - both by the server
     and the client.

Once you have entered all the data, click on the :guilabel:`Download` button.

Effect:
  You will download a *tar.gz* file with the configuration data necessary
  for the client.

configuration 

 by downloading it from the server. To download it
go to the Zentyal 

:guilabel:`Client certificate`: choose a certificate that isn't the
certificate of the server nor is used by any other client. If you don't have
enough certificates, follow the steps of the earlier exercises to create a
certificate the client can use.

: choose a certificate that isn't the

:guilabel:`Server address`: enter an address the client can use
to connect to the server, in this scenario the correct address is the address of
the external interface connected to the visible network - both by the server
and the client.

: enter an address the client can use

Effect:
You will download a *tar.gz* file with the configuration data necessary
for the client.

Access the *Web* interface of the Zentyal server that will take the role of
client. Check that the **VPN** module is enabled Go to the
:menuselection:`VPN --> Clients` section. Here you can see a empty list of
clients and the option to create one. Click on :guilabel:`Add client` and enter a
:guilabel:`name` for it. As it is not yet configured, you will not be able to
enable it and therefore you must return to the list of clients. Click on the
configuration section that corresponds to your client. As you have the client
configuration *bundle*, you do not need to fill in the sections manually. Use
the :guilabel:`Upload the client configuration bundle` option, select the file
obtained in the previous step and click on :guilabel:`Change`. Once you have
loaded the configuration, you can go back to the list of clients and enable
your client. To enable it, click on the :guilabel:`Edit` icon, in the
:guilabel:`Actions` column. A form opens where you can check the *Enabled*
option. Now you have a fully configured client and you just need to save the
changes.

Effect:
  After saving the changes, you have an enabled client. You can
  see this client by viewing the :menuselection:`Dashboard`. If both the server configuration
  and the client are correct, the client will start the connection
  and the tunnel will be ready instantly.

changes.

 interface of the Zentyal server that will take the role of
client. Check that the 

 section. Here you can see a empty list of
clients and the option to create one. Click on 

 for it. As it is not yet configured, you will not be able to

 option, select the file
obtained in the previous step and click on 

. Once you have
your client. To enable it, click on the 

changes.

Effect:
After saving the changes, you have an enabled client. You can
see this client by viewing the :menuselection:`Dashboard`. If both the server configuration
and the client are correct, the client will start the connection
and the tunnel will be ready instantly.

see this client by viewing the 

. If both the server configuration

  Now verify that the computers on internal network and the clients are
  visible to each other. Besides the tunnel, the following requirements
  must be fulfilled:

  * The computers must know the path back to the other private network.
    If, as in this scenario, Zentyal is being used as a gateway, there
    will not be any need for additional routes.

  * The firewall must allow connections between routes for required services.

Once these requirements are verified, you can check the connection.
Therefore, go to one of the computers in the private network - the
VPN server and try to access a service hosted by the other
network.

Once these checks are completed, you must repeat them from a computer located
on the network of a VPN client, choosing a computer
located in the VPN server network as a target.

Now verify that the computers on internal network and the clients are
visible to each other. Besides the tunnel, the following requirements
must be fulfilled:

* The computers must know the path back to the other private network.
  If, as in this scenario, Zentyal is being used as a gateway, there
  will not be any need for additional routes.

* The firewall must allow connections between routes for required services.

The computers must know the path back to the other private network.
If, as in this scenario, Zentyal is being used as a gateway, there
will not be any need for additional routes.

The firewall must allow connections between routes for required services.

network.

In this example you will configure a VPN server and a client on a computer
located on an external network; you will connect to the VPN, through which
you can access to the host located in a local network - and to which only the
server can access through an internal interface.

Access Zentyal, go to :menuselection:`Module status` and enable
:guilabel:`OpenVPN` module, to do this click on the corresponding
box in the *Status* column.

Effect:
  Zentyal requests permission to perform certain actions.

Effect:
Zentyal requests permission to perform certain actions.

Study the actions that will be performed and grant Zentyal
permission carry them out.

Effect:

Access Zentyal interface, go to the section
:menuselection:`VPN --> Servers`, click on :guilabel:`Add new`, a
form with the fields :guilabel:`Enabled` and :guilabel:`Name` will
appear. Enter a name for the server.

Effect:
  The new server will appear on the list of servers.

Click on :guilabel:`Save changes` and accept all changes.

Effect:
  The server is active and you can verify its status in the
  :menuselection:`Dashboard` section.

Effect:
The server is active and you can verify its status in the
:menuselection:`Dashboard` section.

To make the configuration of the client easier, download the
configuration *bundle*. Click the icon in the
:guilabel:`Download client bundle` column and fill in the
configuration form with the following options:

 * :guilabel:`Client type`: select *Linux*, as it is the client OS.
 * :guilabel:`Client certificate`: select *client1*. If this
   certificate is not created, create it following the instructions
   of the previous example.
 * :guilabel:`Server address`: enter here the address that the
   client has to use to connect to the VPN server. In this scenario,
   this address will be the same as the address of the external
   interface connected to the same network as the client computer.

Effect:
 Once the form is completed, you can download a file *bundle* for
 the client. It will be a compressed file in *.tar.gz* format.

 column and fill in the

:guilabel:`Client type`: select *Linux*, as it is the client OS.

:guilabel:`Client certificate`: select *client1*. If this
certificate is not created, create it following the instructions
of the previous example.

. If this

:guilabel:`Server address`: enter here the address that the
client has to use to connect to the VPN server. In this scenario,
this address will be the same as the address of the external
interface connected to the same network as the client computer.

: enter here the address that the

Effect:
Once the form is completed, you can download a file *bundle* for
the client. It will be a compressed file in *.tar.gz* format.

Configure the client computer. Unzip the *bundle* in a directory
and continue with the previously mentioned steps, depending on the
operating system. Note that the *bundle* contains the files with the
necessary certificates and the configuration file with the *.conf*
extension.

If you have not experienced any problems in the earlier steps, the configuration
is now ready and you only need to establish the connection.

Effect:
  The client host is connected to the VPN.

 in a directory
operating system. Note that the 

 contains the files with the
necessary certificates and the configuration file with the 

Before checking that there is a connection between the client and the
computer in the private network, you need to be sure that the latter
uses Zentyal as default gateway. Otherwise, there is no return route to
the VPN client - so you will need to add it.

Finally, check that you can access some of your client services within the
private network.

Effect:
  You have proved that the VPN works, create a virtual network with hosts
  from different networks.

Effect:
You have proved that the VPN works, create a virtual network with hosts
from different networks.

Configure a VPN server using NAT. Follow the same steps as
in :ref:`vpn-example-b-ref`, but enable the NAT option. Connect a
client to the server and check that it is carrying out NAT services correctly.

, but enable the NAT option. Connect a

In order to configure a VPN client on Windows XP, first your system administrator
must give you the *bundle* for your client.

must give you the 

.. figure:: images/vpn/vpn-windows-client1.png
    :scale: 50

    The system administrator gives you the bundle for your client

You must unzip it (click on the file with right button and select
:menuselection:`Extract here`). You will find all the VPN installation files
and related certificates.

). You will find all the VPN installation files

.. figure:: images/vpn/vpn-windows-client2.png
    :scale: 50

    Extracted bundle files

.. figure:: images/vpn/vpn-windows-client3.png
    :scale: 50

    Accept the OpenVPN license

.. figure:: images/vpn/vpn-windows-client4.png
    :scale: 50

    List of modules that will be installed

The network Adapter software is not certified for Windows XP, but it is totally
safe to continue.

.. figure:: images/vpn/vpn-windows-client5.png
    :scale: 50

    Despite the warning you can continue

Once installed, a double click on the shortcut that has appeared in your
desktop allows you to connect to the VPN.

.. figure:: images/vpn/vpn-windows-client6.png
    :scale: 50

    Shortcut to connect to the VPN

To configure a VPN client on Ubuntu; once you have downloaded
the *bundle*, unzip it to a permanent location and
import it into the network configuration manager. To import, click on the
icon located in the *Network Manager* system tray and the menu option
:menuselection:`VPN connections --> Configure VPN...`.

the 

, unzip it to a permanent location and
icon located in the 

Click on :guilabel:`Import` and select the file with *.conf* extension
included in the *bundle*. A window with the imported configuration will open,
click on :guilabel:`Accept` and now you can connect by clicking again on
the icon located in the system tray and selecting the new option that shows
the server name in :menuselection:`VPN connections`.

 and now you can connect by clicking again on
the server name in 

.. figure:: images/vpn/ubuntu_vpn_client.png
    :scale: 50

    Configuration of a VPN client on Ubuntu

In this scenario two offices in different networks need to
be connected via private network. To do this, you will use Zentyal as a
gateway in both networks. One will act as a VPN client and the other as
a server. The following image clarifies the scenario:

.. figure:: images/vpn/two-offices.png
   :scale: 70
   :alt: Zentyal as VPN server vs. Zentyal as a VPN client

   Zentyal as VPN server vs. Zentyal as a VPN client

The goal is to connect the *client 1* on the *LAN 1* with *client 2* on
the *LAN 2* as if they were in the same local network. Therefore, you must
configure a VPN server as previously explained.

 as if they were in the same local network. Therefore, you must

However, you need to make two small changes. First, enable the
:guilabel:`Allow Zentyal-to-Zentyal tunnels` to exchange routes between
Zentyal servers. And then, introduce a :guilabel:`Password for Zentyal-to
Zentyal tunnels` to establish the connection between the two offices in a
safer environment. You should bear in mind that the *LAN 1* network must be
advertised in the :guilabel:`Advertised networks`.

 to exchange routes between
Zentyal servers. And then, introduce a 

 to establish the connection between the two offices in a
safer environment. You should bear in mind that the 

You can configure Zentyal as a VPN client at
:menuselection:`VPN --> Clients`. You must give a :guilabel:`name` to
the client and enable the :guilabel:`service`. You can configure the
client manually or automatically by using the *bundle* provided by the
VPN server. If you do not use the
bundle, you must introduce the :guilabel:`IP address` and
:guilabel:`protocol-port` for the server accepting requests. The
:guilabel:`tunnel password` and :guilabel:`certificates` used by the
client will also be required. These certificates must have been
created by the same **certification authority** the server uses.

. You can configure the
client manually or automatically by using the 

 provided by the
bundle, you must introduce the 

 used by the
created by the same 

.. figure:: images/vpn/04-vpn-eBox-client.png
   :scale: 70

   Client configuration

When you :guilabel:`Save changes` in the :menuselection:`Dashboard`, you can see
a new OpenVPN daemon in the *LAN 2* running as a client and the object
connection towards another Zentyal server within the *LAN 1*.

 running as a client and the object
connection towards another Zentyal server within the 

Screenshot del dashboard de una Zentyal configurada como cliente VPN

.. figure:: images/vpn/05-vpn-dashboard.png
   :scale: 80

   Dashboard of a Zentyal server configured as a VPN client

When the connection is complete, the host with the server role has
access to all routes of the client hosts through the VPN. However,
the hosts with client roles will only have access to those routes
the server has explicitly advertised.

Zentyal can be configured to support remote clients (sometimes known as
road warriors). This means a Zentyal server acting as a gateway
and VPN server with a local area network (LAN) behind it allows
external clients (the *road warriors*) to connect to the local
network via the VPN service.

external clients (the 

.. figure:: images/vpn/road-warrior.png
   :scale: 70
   :alt: Zentyal and remote VPN clients

   Zentyal and remote VPN clients

The goal is to connect the data server with other 2 remote clients (sales
person and CEO) and also the remote clients to each other.

First, you need to create a **Certification Authority** and certificates
for the remote clients. Note that you also need a certificate for the VPN
server. However, Zentyal will create this certificate automatically when
you create a new VPN server. In this scenario, Zentyal acts as a
**Certification Authority**.

 and certificates

Once you have the certificates, then configure the Zentyal VPN server
by selecting :guilabel:`Create a new server`. The only value you need to enter
to create a new server is the name. Zentyal ensures the task of creating a VPN
server is easy and it sets the necessary values automatically.

by selecting 

. The only value you need to enter

The following configuration parameters are added automatically and can be
changed if necessary: :guilabel:`port/protocol`, :guilabel:`certificate`
(Zentyal will create one automatically using the VPN server name) and
:guilabel:`network address`. The VPN network addresses are assigned both
to the server and the clients. If you need to change the *network address*
you must make sure that there is no conflict with a local network. In
addition, you will automatically be notified of local network detail, i.e.
the networks connected directly to the network interfaces of the host,
through the private network.

changed if necessary: 

. The VPN network addresses are assigned both
to the server and the clients. If you need to change the 

Zentyal allows the configuration of VPN with UPD or TCP protocols. UDP is
faster and more efficient as
less control information is transmitted, therefore there is more room
for data. TCP, on the other hand, is more reliable and can cope better
with unstable connections and Internet providers that kill long lasting connections.

As you can see, the VPN server will be listening on all external
interfaces. Therefore, you must set at least one of your interfaces as
external at :menuselection:`Network --> Interfaces`. In this scenario
only two interfaces are required, one internal for LAN and one external
for Internet.

external at 

. In this scenario

If you want the clients to connect between themselves by
using their VPN addresses, you must enable the option
:guilabel:`Allow connections among clients`.

You can leave the rest of the configuration options with their
default values.

.. figure:: images/vpn/02-vpn-server.png
   :scale: 80

   VPN server configuration

After having created the VPN server, you must enable the service
and save the changes. Later you must check in
:menuselection:`Dashboard` that the VPN server is running.

After this, you must establish networks, i.e. routes between VPN networks
and between VPN networks and other networks known by your server. These
networks will be accessible by authorised VPN clients. Keep in mind that
Zentyal will advertise all internal networks automatically. Obviously, you
can add or remove the necessary routes. In this scenario a local network will
automatically be added to ensure the 3rd client is visible to the other
two clients.

Once you have done this, it is time to configure the clients. The easiest way
to configure a VPN client is by using the Zentyal *bundles* - installation
packages that include the VPN configuration file specific to each user and
optionally, an installation program. These are available in the table at
:menuselection:`VPN --> Servers`, by clicking the icon in the column
:guilabel:`Download client bundle`. You can create *bundles* for Windows,
Mac OS and Linux clients. When you create a *bundle* select those
certificates that will be used by the clients and set the external IP addresses
to which the VPN clients must connect. Moreover, if the selected system is
Windows, you can also add an OpenVPN installer. The Zentyal administrator will
download the configuration *bundles* to the clients using the most
appropriate method.

to configure a VPN client is by using the Zentyal 

 - installation

 select those
download the configuration 

.. figure:: images/vpn/03-vpn-client.png
   :scale: 80

   Download client bundle

A *bundle* includes the configuration file and the necessary
files to start a VPN connection.

 includes the configuration file and the necessary

You can see the users currently connected to the VPN service in the
Zentyal :guilabel:`Dashboard`.

Zentyal 

If you need a VPN server that is not the gateway of the local
network, i.e., the host does not have any external interfaces, then you
need to use the :ref:`NAT-ref`. As this is one of the firewall options,
you must ensure that the **firewall** module is enabled, otherwise
you can not enable this option. With this option, the VPN server will act
on behalf of the VPN clients within the local network. In reality, it
will act on behalf of all the advertised networks in order to ensure
that it receives all the response packages that it will later forward
through the private network to its clients. This is best explained by
the following image:

need to use the 

. As this is one of the firewall options,
you must ensure that the 

 module is enabled, otherwise

.. figure:: images/vpn/vpn-nat.png
   :alt: Connection from a VPN client to the LAN with VPN by using NAT
   :scale: 80

   Connection from a VPN client to the LAN with VPN by using NAT

Scenario 1: Virtualized Zentyal server with Internet connection and access from the host machine and internal client

Scenario 2: Virtualized Zentyal server with access from the host and another client with Internet connection through two gateways

Scenario 3: Virtualized Zentyal server with Internet connection and access from the host and two clients

Scenario 4: Virtualized Zentyal server connected to another virtualized Zentyal linking two separate networks

Scenario 5: Virtualized Zentyal server with Internet access, access from the host machine, clients in Internal and External networks

Subscribing Zentyal server to Zentyal Cloud (Basic Subscription)