[2019-11-26]

Webmail using Roundcube

This page deals with the installation of Roundcube as a web mail interface. Roundcube is the software that was also used in the previous versions of this guide. So if your users are used to it… just stay with it.

If my spare time allows it this guide will be extended by alternative mail clients like Horde, Rainloop and Nextcloud.

Installation

Start by installing the software packages:

apt install roundcube roundcube-plugins roundcube-plugins-extra roundcube-mysql

Roundcube stores user settings in the database. So you will get asked to set up database access:

Or course choose mysql when asked:

When asked for a password just press ENTER.

Configure Apache

To get Apache to serve the Roundcube application you need to edit the /etc/apache2/sites-available/webmail.example.org-https.conf file. I suggest you change the DocumentRoot line to:

DocumentRoot /var/lib/roundcube

Also add this line within the same VirtualHost section to add a couple of prepared security settings:

Include /etc/roundcube/apache.conf

And as usual Apache needs to be restarted after the configuration change:

systemctl restart apache2

Limit access to localhost

The main configuration file of Roundcube is located at /etc/roundcube/config.inc.php. Feel free to customize the file. However I suggest that you make these changes:

$config['default_host'] = 'tls://webmail.example.org';

If you do not set the default_host here then Roundcube will ask the user for the name of the mail server at login. We don’t want that.

Also for sending emails you should use the same submission port as other email clients use:

$config['smtp_server'] = 'tls://webmail.example.org';
$config['smtp_port'] = 587;

So now when your users enter https://webmail.example.org/ in their browser they will get the Roundcube webmail application. Voila. Webmail works.

Username == email address

Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the email address as the user name. E.g. ‘john@example.org’ and password ‘summersun’.

Plugins

Roundcube comes with various plugins that you can offer your users. I suggest to use at least these two:

  • password: Let the user change their access password.
  • managesieve: Let the user manage rules that apply to incoming email. They can move mails to specific folders automatically for example.

Again edit the /etc/roundcube/config.inc.php file and look for the plugins configuration. To enable my recommended plugins change it to:

$config['plugins'] = array(
     'managesieve',
     'password',
 );

password plugin

Plugins are configured through files located in the /etc/roundcube/plugins directory. Let’s begin with the password plugin. Edit the /etc/roundcube/plugins/password/config.inc.php file.

Oops, that file looks pretty empty. But it refers us to an example file at /usr/share/roundcube/plugins/password/config.inc.php.dist. There are many different methods to let users change their passwords. As we store that information in the SQL database that is the part we need to set up.

Remove the empty definition line of $config from your config.inc.php file. Let’s go through the required settings one by one:

  • $config['password_driver'] = 'sql';
    Simple. Use SQL as a backend.
  • $config['password_minimum_length'] = 12;
    Allow no passwords shorter than 12 characters. I consider longer passwords more secure than short passwords with weird characters. You can even choose a larger minimum.
  • $config['password_force_save'] = true;
    This will overwrite the password in the database even if it hasn’t changed. It helps us improve the strength of the password hash even if the user chooses to keep his old password.
  • $config['password_algorithm'] = 'dovecot';
    Make Roundcube use the below dovecot-based settings.
  • $config['password_dovecotpw'] = '/usr/bin/doveadm pw -s BLF-CRYPT';
    The command to create a hash for a new password that the user entered.
  • $config['password_dovecotpw_method'] = 'BLF-CRYPT';
    Add a prefix to the password hash that explicitly designates it as a bcrypt hash. That makes it easy if in the future we want to use other hashing algorithms.
  • $config['password_dovecotpw_with_method'] = true;
    Enable the above setting.
  • $config['password_db_dsn'] = 'mysql://mailadmin:gefk6lA2brMOeb8eR5WYaMEdKDQfnF@localhost/mailserver';
    Connection information for the local database. Use your own password for the mailadmin database user here. We cannot use the restricted mailserver user because we have to actually change data in the database.
  • $config['password_query'] = "UPDATE virtual_users SET password=%D WHERE email=%u";
    The SQL query that is run to write the new password hash into the database. %D is a placeholder for the new password hash. And %u is obviously the email address.

Try it. Log into Roundcube as ‘john@example.org’ with password ‘summersun’. Go to the Settings. Choose Password. Enter a new password twice. You should get a success message at the bottom right (yeah, it’s a bit hidden). Now logout and login with the new password. Does it work? Great.

sieve plugin

Sieve is used for server-side rules. Dovecot executes these rules every time a new email comes in. Of course every mailbox can have its own rules. To manage sieve rules Dovecot offers the managesieve interface that you enabled earlier. So we just need to tell Roundcube how to reach it.

The configuration file for Roundcube’s managesieve plugin is found at /etc/roundcube/plugins/managesieve/config.inc.php. Edit the file and again remove the empty or comment the $config line. You can again find all possible configuration options in the /usr/share/roundcube/plugins/managesieve/config.inc.php.dist file.

This time just one setting is required to tell Roundcube which server to talk to:

$config['managesieve_host'] = 'localhost';

Sieve rules are stored in a special syntax on the server. This is an example that moves all incoming emails to the test folder if it contains “test” in the mail’s subject line:

require ["fileinto"];
if header :contains "subject" "test"
{
  fileinto "INBOX.test";
}

But hardly anyone manages rules like that. Roundcube’s rule editor is more user-friendly.

Try adding a sieve rule for john@example.org in Roundcube. If it works you will find the machine-readable sieve code at /var/vmail/example.org/john/sieve/roundcube.sieve.

10 thoughts on “Webmail using Roundcube

  • 2019-12-30 at 21:25
    Permalink

    For completeness, a note to restart Apache should be added – otherwise the changed DocumentRoot directive is not in effect πŸ™‚

    Reply
    • 2019-12-31 at 11:50
      Permalink

      Indeed. Thanks. Added.

      Reply
  • 2020-01-02 at 21:38
    Permalink

    …just in case you are struggling with the same “Could not save new password. Encryption function missing.” error as I did:

    Find the “disable_functions” statement in your php.ini file and check whether the “proc_open” function is listed there. In my case it was. As a result, the subprocess, which is supposed to calculate hash of the new password, could not be spawned properly. The “[…] proc_open() has been disabled for security reasons […]” message in /var/log/roundcube/errors pointed me in that direction.

    Reply
  • 2020-01-04 at 04:37
    Permalink

    In case you edit the php files and the screen comes up empty, take a look in /var/log/apache2/error.log – it always show some clue. My mistake was look into /var/lib/roundcube/logs

    Reply
  • 2020-01-06 at 00:03
    Permalink

    Hello Christoph,

    Thank you for the great tutorials for many years.

    You wrote to set:
    $config[‘smtp_host’] = ‘tls://webmail.example.org’;
    I don’t find that in my roundcube config. I did find:
    $config[‘smtp_server’] = ‘localhost’;

    I guess it is probably the same but maybe you can confirm that?

    Reply
    • 2020-01-07 at 08:09
      Permalink

      Oops, I mixed up default_host and smtp_server. Thanks for spotting.

      Reply
  • 2020-01-06 at 03:25
    Permalink

    $config[‘smtp_server’]=’tls://webmail.example.org’ works for me.

    Reply
  • 2020-01-12 at 22:41
    Permalink

    The test-user is ‘john@example.org’, not ‘john@example.com’.

    Reply
    • 2020-01-12 at 23:26
      Permalink

      Yes – at this moment I also stopped and looked for where I have something wrong entered πŸ™‚
      Great tutorial – many thanks!
      I have several mail servers on Deban without mysql but now I am happy to read and set up a new server. Many thanks for your work.

      Reply
    • 2020-01-14 at 12:03
      Permalink

      Ouch. Thanks. Fixed.

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *