It has always been the case that system administrators are skeptical of anything new. Everything, from new server platforms to software updates, is viewed with caution until practical experience and positive feedback from colleagues in other companies arise. This skepticism is understandable: when you are literally responsible for the operational efficiency of a business and the protection of critical information, you eventually stop trusting even yourself, let alone contractors, subordinates, or regular users.
The distrust towards software updates stems from numerous unpleasant incidents where installing fresh patches led to decreased performance, changes in user interfaces, system failures, or, particularly unpleasantly, data loss. However, completely abandoning updates is not an option; otherwise, your company's infrastructure can be vulnerable to cybercriminal attacks. One only needs to recall the notorious WannaCry incident, where data stored on millions of Windows computers that had not been updated to the latest version became encrypted. This incident not only cost hundreds of system administrators their jobs but also clearly demonstrated the need to develop a new software update policy within the company that balances security and the speed of installation. In anticipation of the release of the LTS version of Zimbra 8.8.15, let's look at how to update the Zimbra Collaboration Suite Open-Source Edition to ensure the safety of all critical data.
One of the main features of Zimbra Collaboration Suite is that almost all its components can be duplicated. In particular, in addition to the main LDAP-Master server, you can add duplicate LDAP-replicas, to which, if necessary, you can transfer the functions of the main LDAP server. Proxy servers and MTA servers can also be duplicated. This duplication allows for the temporary removal of certain components from the infrastructure for maintenance, thus reliably protecting against prolonged downtime and data loss in case of an unsuccessful update.
Unlike other components of the infrastructure, duplication of mail storage in Zimbra Collaboration Suite is not supported. Even if your infrastructure has several mail storages, the data of each mailbox can only reside in one mail storage. serverThis is why one of the key rules for data integrity during an update is to back up the information on the mail storages in a timely manner. The fresher your backup, the more data will be preserved in the event of an emergency. However, there is a caveat: the free version of Zimbra Collaboration Suite lacks a built-in backup mechanism, and to create backups you will need to use the built-in tools of GNU/Linux. Additionally, if you have multiple mail storages in your Zimbra infrastructure and the size of the mail archive is quite large, then each backup can take a very long time, creating significant load on the local network and the servers themselves. Moreover, during lengthy copying, the risks of unforeseen incidents sharply increase. Also, if such backups are performed without stopping the service, there is a risk that some files may be copied incorrectly, leading to the loss of some data.
That’s why, if you need to back up large volumes of information from mail stores, it’s better to use incremental backup, which avoids the need for complete copying of all data and instead only backs up files that have been added or changed since the last full backup. This significantly speeds up the backup process and allows you to start installing updates quicker. Incremental backups in Zimbra Open-Source Edition can be achieved with the Zextras Backup modular extension included in the Zextras Suite.
Another powerful tool, Zextras PowerStore, allows a system administrator to deduplicate data on the mail store. This means that all duplicate attachments and repeated emails on the mail server will be replaced with a single original file, and all duplicates will become transparent symbolic links. This not only leads to significant savings in hard drive space but also reduces the size of backups, which in turn allows for faster full backups and more frequent backup operations.
However, the key feature that Zextras PowerStore provides for safe updates is the ability to transfer mailboxes between mail servers in Zimbra multi-server infrastructures. This capability allows the system administrator to perform the same operations with mail stores as we did with MTA and LDAP servers for their safe updates. For example, if there are four mail stores in the Zimbra infrastructure, it’s possible to redistribute mailboxes from one of them to the other three, and once the first mail store is emptied, it can be updated without concerns for data safety. If the system administrator has a spare mail store in the infrastructure, it can be used as a temporary holding area for mailboxes relocated from the mail stores being updated.
Such a transfer can be executed with the console command DoMoveMailboxTo utilize it for transferring all accounts from the mail storage, it is necessary to first obtain their complete list. To achieve this, execute the command on the mail server zmprov sa zimbraMailHost=mailbox.example.com > accounts.txt. After executing it, we will receive a file accounts.txt containing the list of all mailboxes in our mail storage. After this, it can be immediately used to transfer accounts to another mail storage. It will look something like this:
zxsuite powerstore doMailboxMove reserve_mailbox.example.com input_file accounts.txt stages data
zxsuite powerstore doMailboxMove reserve_mailbox.example.com input_file accounts.txt stages data,account notifications admin@example.com
The command is executed twice: the first time to copy all data without transferring the actual account, and the second time, since the data transfer is incremental, to copy any new data that has appeared since the first transfer and then transfer the accounts themselves. Please note that the account transfer involves a brief period of mailbox unavailability, so it would be wise to inform users about this. Additionally, after the second command is completed, the administrator receives a corresponding notification via email. This allows the administrator to promptly begin updating the mail storage.
If the software update for the mail storage is being done by a SaaS provider, it would be much more reasonable to transfer data not by accounts, but by the domains located on it. For this purpose, it is sufficient to slightly modify the command as follows:
zxsuite powerstore doMailboxMove reserve_mailbox.saas.com domains client1.ru, client2.ru, client3.ru stages data
zxsuite powerstore doMailboxMove secureserver.saas.com domains client1.ru, client2.ru, client3.ru stages data,account notifications admin@saas.com
After the accounts and their data have been transferred from the mail storage, the data on the original server ceases to hold any significance, and you can begin updating the mail server without any concerns for their safety.
For those who wish to minimize downtime when transferring mailboxes, a fundamentally different scenario for using the command is ideal. zxsuite powerstore doMailboxMove, which means that the migration of mailboxes is carried out directly to the updated servers, without the need for intermediate steps. servers. In other words, we are adding a new mail storage to the Zimbra infrastructure, which is already updated to the latest version, and then simply migrating accounts from the outdated server following the familiar procedure, repeating this until all servers in the infrastructure are updated.
This method allows for a one-time migration of accounts, thereby reducing the time during which mailboxes remain unavailable. Moreover, it requires only one additional mail server for implementation. However, administrators deploying mail storages on servers with different configurations should proceed with caution when using it. The fact is that migrating a large number of accounts to a weaker server could negatively impact the service's availability and responsiveness, which can be quite critical for large enterprises and SaaS providers.
Thus, with Zextras Backup and Zextras PowerStore, a Zimbra system administrator can update all nodes of the Zimbra infrastructure without any risk to the information stored on them.
Source: habr.com
