MTA servers

info

This page is for a multi-server installation only. Install the Web admin server before you continue. Java 21 or later must be installed on this host too, see Java.

Every Zimbra MTA server runs two of the three services:

Component	Service unit	Default port	Purpose
msh-zr-node	msh-zr-node.service	7082	Receives the rules and settings from the web admin for the milter on this host
msh-zr-milter	msh-zr-milter.service	7080	Milter engine (processes mail for the Zimbra MTA)

The web admin is not started here. It connects to this host on port 7082 and sends the rules, the settings and the license.

Repeat this page for each MTA server.

Commands

sudo useradd --system --no-create-home --shell /usr/sbin/nologin --home /opt/msh-zr msh
sudo tar zxvf msh-zr-<VERSION>.tgz -C /opt
sudo sh /opt/msh-zr/lib/fixperms.sh
sudo systemctl link /opt/msh-zr/lib/msh-zr-node.service /opt/msh-zr/lib/msh-zr-milter.service
sudo systemctl daemon-reload
sudo systemctl enable msh-zr-node.service msh-zr-milter.service
sudo systemctl start msh-zr-node.service msh-zr-milter.service

The first three commands are the same as on a single server, see the description there. Only the node and milter units are linked, enabled and started. Use the same package version as on the web admin server.

Verify

systemctl status msh-zr-node.service msh-zr-milter.service

Both must show Active: active (running). Live logs:

journalctl -u msh-zr-node.service -u msh-zr-milter.service -f

Open the node port to the web admin

The web admin connects to this host on TCP 7082. Allow it from the web admin server only, for example with ufw:

sudo ufw allow from <web-admin-server-ip> to any port 7082 proto tcp

Do not open port 7080: only the Zimbra MTA on this host talks to the milter. See Ports and firewall.

Copy the node token

On its first start the node created an access token. The web admin needs it to connect. Print it:

sudo cat /opt/msh-zr/etc/node.token

Treat the token like a password: anyone who has it and can reach port 7082 can send settings to this server.

Add the server in the web admin

1. Log in to the web admin and open the Servers page.
2. Click Add Server... and fill in:
   • Name - how the server is shown in the web admin, for example MTA1.
   • Host - the host name or IP address of this MTA server, as the web admin server reaches it.
   • Port - 7082, unless you changed NODE_PORT in etc/config.cf on this host.
   • Token - the content of etc/node.token from the step above.
3. Click Add.

The web admin connects to the server before it adds it, so a wrong host, port or token is reported right away. Once added, the server gets the rules, settings and license, and its state on the Servers page changes to Up to date.

What's next

• Zimbra configuration - wire the milter into the Zimbra MTA of this server
• Servers - server states and what to do when a server is not up to date