Web admin server
This page is for a multi-server installation. For a single Zimbra server, follow Single server instead. Java 21 or later must be installed on this host, see Java.
In a multi-server installation the web admin runs on a server of its own. It is the only service on that server:
| Component | Service unit | Default port | Purpose |
|---|---|---|---|
msh-zr-web | msh-zr-web.service | 7081 | Web admin UI. Holds the rules and settings and sends them to every MTA server |
The web admin server needs to reach every MTA server on TCP 7082, the Zimbra LDAP on TCP 389 (or your LDAP port) and license.mshsoftware.com on TCP 443. See Ports and firewall.
Commands
sudo useradd --system --no-create-home --shell /usr/sbin/nologin --home /opt/msh-zr msh
sudo tar zxvf msh-zr-<VERSION>.tgz -C /opt
sudo sh /opt/msh-zr/lib/fixperms.sh
sudo systemctl link /opt/msh-zr/lib/msh-zr-web.service
sudo systemctl daemon-reload
sudo systemctl enable msh-zr-web.service
sudo systemctl start msh-zr-web.service
The first three commands are the same as on a single server, see the description there. Only the web admin unit is linked, enabled and started.
Verify
systemctl status msh-zr-web.service
It must show Active: active (running). Live logs:
journalctl -u msh-zr-web.service -f
The same output is also appended to /opt/msh-zr/var/log/web.out.
First login
Open the web admin UI in your browser:
http://<host>:7081
The first login uses the seeded admin / admin account. Change the password immediately on the Access Control page.
The Servers page is empty at this point, and the Dashboard shows the notice No server is configured, so rules are not applied to any mail. You add each MTA server there once it is installed, see MTA servers.
Next, set up the Directory service so the web admin can read users and groups from the Zimbra LDAP.
Enable HTTPS for the web UI (recommended)
The web UI serves plain HTTP by default, which sends the administrator password in clear text over the network. Enable HTTPS the same way as on a single server, see Enable HTTPS for the web UI.
What's next
- MTA servers - install the node and milter on every MTA server and add them on the Servers page