My experience with Zentyal

Greetings to all, it has been a long time since I wrote in DesdeLinux for work reasons and today I want to share an experience that departs somewhat from the published for my web development and get into administration.

After some time managing the network of the company where I work, there was a need to migrate the existing configuration for the management of the domain and basic services of our intranet.

The existing configuration was based on Debian + Samba 3 + LDAP, BIND9 + Postfix and everything else that hangs for the creation of a PDC in Linux and that provides services to PCs with Windows XP system and higher. This scenario presented difficulties in maintenance and made the process of user management and recovery from a possible failure cumbersome.

After analyzing the existing possibilities and looking for the almost ideal balance, we opted for the use of Plant, solution that displays all the services needed by us.

Plant (formerly named eBox) is a solution for small and medium-sized companies, which takes the best of Free Software and unifies all or almost all the needs in a network with a business nature or not. Among the solutions it provides we can mention: management of network infrastructure, gateway, office or communications server, to mention the main ones.

Many are the elements that are analyzed when selecting a system and in particular in the selection of Zentyal, the documentation, the community support, the base of the system (which although it is Ubuntu Server LTS although I would prefer Debian), the way in which It is managed and that in a single CD we have everything we need, were the factors that made it our choice.

So far, it seems to me that it has been shown that for us Zentyal is the solution, so we must enter into the matter, but something if I want to clarify, I do not intend to turn this post into a tutorial on how to deploy Zentyal, but rather to talk about those details that normally hinder the adoption of a platform or system and I explain why not to talk about the installation.

On the Zentyal documentation site, it covers the entire process in detail and the best in our language, becoming an obligatory point of reference.

Once the installation is completed and the services to be deployed have been selected, many users have encountered the problem that when adding a new service at another time, it is impossible, since they cannot use the CD of our installation, why does this happen? the package manager simply ignores it.

Reviewing the apt configuration files, notice that it was not referenced in the source.list to the installation CD and yes to various Ubuntu and Zentyal repositories. The solution is very simple and you only need to use the command:

$ sudo apt-cdrom add

It adds our installation CD to the source.list that we have previously commented on all the existing lines in it and at this moment we can add as many services as we want from those provided by Zentyal.

At this point I have installed my Zentyal with the necessary services in our company and this is where the second obstacle arises.

The mail service in Zentyal uses Postfix and Dovecot, its configuration is quite simple, allowing direct delivery in the case of companies or institutions facing the Internet or using smarthost and this is my case, but the server delivery that makes relay on our network was impossible.

After spending several hours breaking our heads and a few calls to our friend Elav who has experience in Zentyal, we realized that in the parameter mynetworks in the main.cf from Postfix the ip of our relay was not declared and the magic was done and our server was already receiving and sending our relay.

But happiness is never complete, when resetting the settings of the main.cf postfix had changed to its previous state and this was because, well, Zentyal's philosophy is based on the management of system configuration files through templates, which are found in / usr / share / zentyal / stubs / and they are grouped by the different services so the desired options are modified or added and when restarting the service or the same server the changes will be permanent in the configuration files.

In the official documentation the "Advanced customization of services" section explains in detail how to make adjustments to the configuration templates and the recommended practice to modify the configuration templates, an option that I currently use.

My brand new server with Zentyal already at this point, provided all the services in my network without problems, on the contrary what at one time was an odyssey, it was not. PCs with Microsoft Windows XP and above were joining the domain smoothly and this is one of the big changes in Zentyal 3 when using Samba 4.

The following services were already available in our network:

• Webmail with the amazing Roundcube interface.
• Proxy and its configuration in the browsers through automatic configuration (my contribution).
• Time server through ntp.
• A complete PDC for stations in Microsoft Windows.
• Firewall service for network nat and access control.
• Messenger Service.
• Monitoring of services.
• User and service administration interface.

Up to this point, what was left to do? Well, to get the users of certain groups to have access to the domains through the Proxy that would be allowed and the truth that Zentyal simplifies this process, but as I said before, happiness is not complete. Many sites of the allowed domains include links to other domains, so it began to skip the authentication dialog to users in an intrusive way.

Again I checked the service configuration again in this case SQUID3 and to my surprise it was a line that denied those users just before the http_access deny allIf I only allowed him to navigate in certain domains because Zentyal added a line to deny the group to which those users belonged? Good question but I don't really know the answer and what frustrated me for a moment was that Zentyal's template system couldn't help me.

And where was the solution? Where else, in the same Zentyal documentation. In the section "Advanced customization of services", it is explained how to execute scripts during the process of applying the changes in the configuration of the services.

There are 6 entry points for the execution of these scripts also known as hooks. Two of them are general and the other four are per module: Before saving changes, after saving changes, before saving the configuration of a module, after saving the configuration of a module, before restarting the service and after restarting the service.

Zentyal provides a group of templates for creating these hooks which are basically bash scripts. Well with the help of the command BUT and the use of hooks before starting the navigation service eliminates the unnecessary line, and then starts the service, disappearing the intrusion of the authentication dialog in users where their navigation is limited to a group of domains.

Well now, I did not have any more setbacks and only small adjustments remained that through the administration interface is a matter of a few clicks and everything is done. My conclusions and recommendations will not be so extensive, rather I want to touch points that are not normally touched.

1. First of all, Zentyal as a solution is mature and stable in all senses and in continuous development, which is why it is viable in our companies and institutions.
2. A great advantage is that a single CD we have everything we need and what is missing according to our needs, it will be enough to add the Ubuntu repository and that's it.
3. The template system is not a disadvantage, on the contrary if we use it together with the hooks we have a complete combination and it does not generate dirty configuration files, on the contrary they can be used as a reference in other systems.
4. The administrator's work is simplified considerably, allowing him to concentrate on more specific tasks.
5. It does not deprive you of the knowledge and use of the console at all when using the administrative interface, it is just another utility of the system, being able to fully exploit the possibilities of the console (own experience).

So far my experience, although short in time, has been beneficial, so I wanted to share it with you. Shortly, small tips for the deployment of other applications and services in Zentyal.