New user accounts can be defined in the Domain Settings → Users section.
Figure 14.1 User accounts
First, choose a local domain in the Domain field, in which the accounts will be defined.
Each domain may include local accounts as well as accounts saved in a directory service (e.g. Microsoft Active Directory). Both can be displayed in the Users section in the Kerio Administration Console. However, only local accounts can be added (accounts for directory services must be created with the respective administration tools, e.g. Active Directory Users and Computers). Some of the features of accounts within a directory service can be edited.
14.2 Creating a user account
Warning: If an account mapped from the directory service is deleted in the administra-tion console, the account is disabled in Kerio MailServer.
Note: The roles of each column of this window will be better understood through the fol-lowing descriptions. The only exception — the Data source column — displays account types:
• Internal — the account is stored in the internal user database
• LDAP — the account is saved in a directory service (Active Directory, Open Directory) Click on the Add button to open a guide to create a new user account. If the domain is configured to be used with directory services (see chapter 8.6), a dialog where you can define whether you would like to activate users from a directory service or create a new local account will be displayed.
If a user is activated, a user account is saved into the directory service. Since the acti-vation it can be used by Kerio MailServer. All events and information will be saved into the directory service.
Figure 14.2 Activate user in directory service
If the Activate user in directory service option is selected, a dialog with user list of the LDAP database used by Kerio MailServer will be opened. Select appropriate users and confirm the selection. The buttons bottom left make user selection more comfortable.
Select all — this button selects all users. The Unselect all option clears any selection.
The following guide shows how local user accounts can be defined.
Chapter 14 User accounts
Step 1 — Template
The first step is shown only in case at least one template is created. To create the new user mailbox template, select Definition → User templates. The template is useful especially for creating multiple user accounts at once that have some parameters in common (e.g. authentication type, quotas, etc.). When all these common parameters are entered in a template, it can save a lot of time.
Figure 14.3 New user addition — a template
For information about creation of a new template, refer to chapter14.11.
Step 2 — Basic data Login name
User login name (note: the domain must be the local primary domain; otherwise enter the full email address, e.g. [email protected], not only user).
The username is not case-sensitive.
Warning: The login name must not contain national characters and some of the special characters (see the Allowed and prohibited characters in the user name) Examples of correct names:
wayne, john.wayne, ing.john.wayne, john_wayne, wayne, john---wayne, john_paul-wayne, john_-_wayne-_
Examples of incorrect names:
john..wayne, john...wayne, john.wa.yne, .wayne, wayne.
Full Name
A full name of the user (usually first name and surname). This option is required, if the user data from this account are to be exported to a public contacts folder.
14.2 Creating a user account
Figure 14.4 New user addition — basic data
Character Allowed Character Prohibited
a-z allowed / prohibited
0-9 allowed \ prohibited
A-Z allowed .. prohibited
. allowed when not at the
beginning and/or the end of the string and when there are not two dots next to each other
. prohibited when at the
beginning and/or at the end of the string
- allowed * prohibited
_ allowed
Table 14.1 Allowed and prohibited characters in the user name
Description
Chapter 14 User accounts
matory purposes only. They can contain any type of information or they can be left blank.
Authentication
Possible authentication methods:
• Internal user database
Users are only authenticated within Kerio MailServer. In this case a password must be entered in the Password and Confirm Password fields (the user can then change his/her password in the Kerio WebMail interface).
Warning: Passwords may contain printable symbols only (letters, numbers, punctuation marks). Password is case-sensitive.
• Windows NT domain
Users are authenticated in a Windows NT domain. The NT domain name must be entered in the email domain properties (Windows NT domain in the Advanced tab). This authentication method can be used only if Kerio MailServer is running on Windows 2000/XP/2003. For details, see chapter8.7.
• Kerberos 5
Users are authenticated in the Kerberos 5 authentication system..
• PAM service
Authentication using the PAM service (Pluggable Authentication Module), avail-able only in the Linux operating system.
• Apple Open Directory
Authentication against Apple Open Directory database (only for mailservers in-stalled on a Macintosh). The option can be selected only if the user is mapped from Apple Open Directory.
Password / Confirm Password
Only the local user password can be entered or changed. We strongly recommend to change the password immediately after the account is created.
If the password contains special (national) characters, users of some mail clients will not be able to log in to Kerio MailServer. It is therefore recommend to use only ASCII characters for passwords.
WAP Service
Kerio MailServer enables access to email using a cellular telephone from the WAP protocol. This interface is called WAPmail (it uses the same ports as HTTP and Secure HTTP services).
To enable the service, check Enable access to WAP service and enter at least 4 digits (max. 32 characters) to specify your PIN numeric code. (including from 4 to 32 characters). This code will be used for authentication to the service.
Warning: Since Kerio MailServer 6.0.5, the PIN code is stored in the new SHA for-mat — see Store password in high secure SHA forfor-mat (recommended). For this
14.2 Creating a user account
reason, the original PIN will not work if downgraded to a previous version of Kerio MailServer and must be changed.
Enable a default spam filter ...
Upon creating a new user account, check this option to set the antispam rule. All in-coming emails marked as spam will be automatically moved to the Junk mail folder.
The rule can be set up only during the process of user account creation. For more information about the filter and rules for incoming messages, see chapter31.11.
Warning: It is not recommended to create this rule when the user accesses emails via POP3. In such case, only the INBOX folder is downloaded to the local client and the user is not able to check if the emails moved to the Spam folder are really spam emails.
Store password in high secure SHA format (recommended)
By default, user passwords are encrypted by DES. The Store password in highly secure SHA format allows for a more secure encryption (SHA string). This option has one disadvantage — some methods of Kerio MailServer access authentication (APOP, CRAM-MD5 and Digest-MD5) cannot be applied. The only methods available for this option are LOGIN and PLAIN (it is highly recommended to use only SSL connection for authentication).
If this option is enabled, it is necessary to change the user password. This can be done either by administrator or the user (e.g. by Kerio WebMail).
Warning: Passwords saved in SHA are supported by Kerio MailServer 6.0.5 adn later. If a configuration with SHA passwords is applied to an older version of Kerio MailServer, the authentication will not function.
Account is disabled
Temporary blocking of the account so that you do not have to remove it.
Step 3 — Mail addresses
In this step, all required email addresses of the user can be defined. The other addresses are called aliases. The other addresses are called aliases. These can be defined either during the user definition or in Domain Settings/Aliases. We recommend to use the first alternative — it is easier and the aliases are available through Active Directory.
Note: If user accounts are maintained in Active Directory (see chapter8.6), their aliases can be defined in Active Directory Users and Computers. Global aliases (in Domain Set-tings → Aliases) cannot be defined this way.
Chapter 14 User accounts
Figure 14.5 New user addition — email addresses
Step 4 — Forwarding messages to other addresses
Messages for a user can be forwarded to other email accounts if defined. If the Deliver messages to... button is activated, messages will be saved in the local account and for-warded to the addresses defined by user (if not, messages will be forfor-warded only, not saved).
Note: The same functionality can be accomplished through the Domain Settings → Aliases dialog; however, aliases created within the user definition dialog is smoother and easier to follow.
14.2 Creating a user account
Figure 14.6 New user addition — forwarding messages to other addresses
Step 5 — Groups
In this dialog window, you can add or remove groups of which the user is a member.
Groups must be created first in the Domain Settings → Groups section. You can add users to groups during definition of groups. Therefore, it is not important which is created first — users or groups.
Figure 14.7 New user addition — groups
Chapter 14 User accounts
Step 6 — Access rights
Each user must be assigned one of the following three levels of access rights.
No access to administration
These users do not have any access to Kerio MailServer administration. Most users will have this setting so they will only be able to access their own mailboxes.
Figure 14.8 Creating a user — user rights
Read only access
These users can connect to Kerio MailServer administration but they can only view the logs and settings; they cannot make any changes.
Read/Write access
The user can read or edit all the records and settings and his or her rights are equal to the administrator rights (Admin). If there is at least one user with such rights, the Admin account can be removed.
User can administer aliases and users/groups ...
A special access right to Kerio MailServer Web Administration (for more informa-tion, see chapter27). This setting is independent on the access rights settings for Kerio Administration Console.
14.2 Creating a user account
This user has the administrator rights...
By default, only Admin of the primary domain is allowed to administer the public folders. If there are multiple local domains with user accounts in Kerio MailServer, this option must be selected at least for one user in each domain. Each domain in Kerio MailServer has its own public folders and users of a different local domain are not allowed to access it (you can change this setting so that all public folders are accessible from all domains and from all users — for detailed information about this setting, see chapter8.1).
By default, all users from one domain have read only rights for the public folders.
The rights for public folders can be assigned by any user that has the administrator rights. The rights can be also assigned using the Kerio WebMail interface and MS Outlook with Kerio Outlook Connector.
Step 7 — Quota
You can set limits for each user’s mailbox.
Figure 14.9 New user addition — quota
Disk space
The maximum space for a mailbox. For greater ease in entering values you can choose between kilobytes (KB), megabytes (MB) or gigabytes (GB).
Number of messages
The maximum number of messages in the mailbox.
Chapter 14 User accounts
The value of either of these items can be set to 0 (zero), which means that there is no limit set for the mailbox.
The user quota prevents cluttering of the server disk. If either of the limits is reached, any new messages will be refused by the server.
When the quota is reached, the user will receive a warning message including recommen-dation on deleting some messages. It is also not important iif the quota was exceeded by number of messages or by the reserved disc space capacity. The quota is reached at the moment when an incoming message (or an event, a contact or a task) exceeds one of these limits.
The treshold of 90 per cent of the quota value is set (90 per cent of the limit set for the number of messages or 90 per cent of the disc space reserved). When this treshold is reached, an informatory message is send to the particular user. This value can be edited manually in the Kerio MailServeru’s configuration file, as follows:
1. Stop the Kerio MailServer Engine.
2. In the directory where Kerio MailServer is installed, search the mailserver.cfg file 3. Open the mailserver.cfg file and look up the QuotaWarningThreshold value. The
line is as follows:
<variable name="QuotaWarningThreshold">90</variable>
4. Change the value as needed and save the file.
5. Run Kerio MailServer.
These wanrning messages are sent each 24 hours (not more frequently). Even if a user removes messages to get under the quota treshold and then exceeds it again, the next informative message will be sent after 24 hours from the first informatory message.
Step 8 — Advanced settings This user can send/receive ...
Using this option, the administrator of Kerio MailServer can limit communication only to the local domain. This can be useful for internal communication settings in many companies. Users will not be able to send or receive emails to/from any other domain.
14.2 Creating a user account
Figure 14.10 New user addition — publish user information to the public contacts folder
Maximum message size
Use this option to set the size limit for outgoing messages. The size limit can be ei-ther set for each user separately, or globally for the whole domain (see chapter8.1).
If no size limit is specified for the whole domain, it is recommended to set this option.
By setting the size limit, you can prevent the internet connection from being over-loaded by emails with large attachments.
If both limits are set to 0, Kerio MailServer behaves the same way as if no limit was specified.
Limit set for a specific user has higher priority than limits applied to the entire domain.
Publish this user information to ...
Check this option to add the user contact to the public contacts folder. The contact will be added to the public folder only if the Full name field is populated (in the first or second step of the wizard).
Note: When importing users from Kerio MailServer 5, only the primary domain users will be added to the public contacts folder.
Chapter 14 User accounts