Now that you have a valid key and certificate and installed the Roundcube packages we are ready to set up your webmail service. The Apache web server installation on Debian stores all virtual host configurations in /etc/apache2/sites-available/. There are two files after a fresh Apache installation:
- 000-default.conf serves the /var/www directory via HTTP and is enabled by default. We will edit this file so that if a user accesses your web server via HTTP they will be redirected to the HTTPS site.
- default-ssl.conf serves the /var/www directory via HTTPS. It uses an automatically created self-signed “snake oil” certificate. We will enable this virtual host and configure the Roundcube webmail interface.
If you want to enable such a virtual host configuration you can use the “a2ensite” (Apache version 2 enable site) command. It will create a symbolik link from /etc/apache2/sites-available/FILE to /etc/apache2/sites-enabled/FILE.
Note: Debian Jessie ships with Apache version 2.4. This requires that all configuration files end with “.conf”. Expect confusing errors if you omit that suffix.
Virtual host for HTTPS
Edit the file /etc/apache2/sites-available/default-ssl. Change these two lines to make Apache use the key and certificate you created earlier:
SSLCertificateFile /etc/ssl/certs/mailserver.pem SSLCertificateKeyFile /etc/ssl/private/mailserver.pem
Also add these two lines to include Roundcube anywhere in that file between the <VirtualHost…> and the </Virtualhost> tag:
Include /etc/roundcube/apache.conf Alias / /var/lib/roundcube/
Enable this virtual host:
a2ensite default-ssl
Also enable the “mod_ssl” module and make Apache listen to port 443:
a2enmod ssl service apache2 reload
If everything works fine you will see an “[ ok ]” message. If not please run “apache2ctl configtest” to see if Apache detects any obvious problems. Or check out the /var/log/apache2/error.log log file for further hints.
Now if you point your web browser to http://YOURSERVER/ it will show the webmail interface.
You could already log in by entering “localhost” as a server. But let’s improve the configuration a litte. The “Server” is always “localhost”. So edit the /etc/roundcube/config.inc.php file and set:
$config['default_host'] = 'localhost';
Now when you reload the login form the “Server” field should be gone.
Set up HTTP to HTTPS redirection
For those users who forget to type “https” instead of “http” let us also set up an automatic redirection so that they will be forwarded to the secure URL. Edit the /etc/apache2/sites-available/000-default file and insert
Redirect permanent / https://YOUR.MAIL.SERVER/
anywhere within the VirtualHost section. Of course you have to replace YOUR.MAIL.SERVER with the fully-qualified domain name of your mail server. This configuration is enabled by default so you just need to reload the web server to make your change work:
service apache2 reload
Plugins
Further down in /etc/roundcube/config.inc.php there is a list of plugins that Roundcube loads. The “archive” and “zipdownload” plugins are proably already enabled. Add the “managesieve” and “password” plugins so that the setting looks like this:
$config['plugins'] = array( 'archive', 'zipdownload', 'managesieve', 'password', );
Next an optional setting. The default session lifetime in Roundcube is 10 minutes. That means if a user is not using the webmail interface for more than 10 minutes they will be logged out. I found that annoying and increased that timeout to one hour. To do that at the end of the config file add:
$config['session_lifetime'] = 60;
And if you would like to change the default logo of Roundcube that can be done by setting:
$config['skin_logo'] = './ispmail-logo.png';
You just need to copy that image file by that name to /var/lib/roundcube/ispmail-logo.png. The logo should be 177×49 pixels large. Feel free to take this nifty ISPmail logo I crafted. 🙂
If the logo appears to be broken then make sure that the permissions are correct:
chmod a+r /var/lib/roundcube/ispmail-logo.png
When you reload the login form in the browser it will then look like this instead:
Configuring the managesieve plugin
The “managesieve” password will allow your users to manage automatic rules to manage their email. These rules are stored on the server and will be run automatically. You need to configure this plugin though. A default configuration can be found at /usr/share/roundcube/plugins/managesieve/config.inc.php.dist on your system. Copy it to the location where Roundcube will look for it:
cp /usr/share/roundcube/plugins/managesieve/config.inc.php.dist /etc/roundcube/plugins/managesieve/config.inc.php
No further changes are required.
Configuring the password plugin
We urge our users to change their passwords frequently. So we need to give them a chance to actually do that. Copy the default configuration file /usr/share/roundcube/plugins/password/config.inc.php to the right place:
cp /usr/share/roundcube/plugins/password/config.inc.php.dist /etc/roundcube/plugins/password/config.inc.php
The configuration file at /etc/roundcube/plugins/password/config.inc.php requires a couple of changes though. We need to tell it how our database works and what to do when a user wants to change their password. The first setting deals with the minimal length of the password. I recommend to enforce at least 10 characters. In fact the complexity of the password is not that important. Consider XKCD as food for thought on password security. So set:
$config['password_minimum_length'] = 10;
We should allow the user to use the old password as the new password. It may sound stupid but as we are upgrading the password scheme from the weak unsalted MD5 to the better SHA2 algorithm we should allow that:
$config['password_force_save'] = true;
Next the password plugin needs to know how to access your database:
$config['password_db_dsn'] = 'mysql://mailuser:ChangeMe@127.0.0.1/mailserver';
Replace “ChangeMe” by the randomly generated password you created earlier for the “mailuser” MySQL user.
Now tell the plugin how to actually write the new password hash into the database:
$config['password_query'] = "UPDATE virtual_users SET password=CONCAT('{SHA256-CRYPT}', ENCRYPT (%p, CONCAT('$5
Whoa, that looks weird, doesn’t it? That SQL query generates a password hash from these parts:
- The string “{SHA256-CRYPT}”. It tells Dovecot explicitly that this password is a salted SHA256 hash. You may have different kinds of encrypted passwords in your database so this makes it clear.
- The actual encrypted password that is generated using your operating system’s crypt() function (MySQL calls it when you use the ENCRYPT SQL function) using…
- The new plaintext password (Roundcube replaces “%p” by it).
- “$5$” – that stands for using the SHA-256 algorithm. Check “man crypt” to see which algorithms are supported by crypt().
- And SUBSTRING(SHA(RAND()), -16) is used as a salt. A salt is just some additional randomness that makes it much much harder to reverse-engineer the actual password from the encrypted string.
- And of course we just want to change the password of the current email user. So “WHERE email=%u” makes sure we choose the right row in the database. Roundcube replaces “%u” with the user name – which is the same as the email address in our case.
(I used to recommend just using “dovecot pw -s SHA256-CRYPT” to generate passwords. You can do that, too. But in fact MySQL is capable of generating salted SHA256 hashes without calling any shell command. Thanks for the hint, Martin.)
Alright. Roundcube is now set up. But to be able to login and use it we need to install and configure Dovecot first. So don’t worry if the login does not work yet.
Trying it out
That was a lot of theory and configuration. Let’s finally try it. Go to https://YOUR.MAIL.SERVER/ and login as…
If everything works as intended you will be logged in and see…
If that didn’t work then check your /var/log/mail.log and /var/log/roundcube/errors files for errors.
, SUBSTRING(SHA(RAND()), -16)))) WHERE email=%u;”;Whoa, that looks weird, doesn’t it? That SQL query generates a password hash from these parts:
- The string “{SHA256-CRYPT}”. It tells Dovecot explicitly that this password is a salted SHA256 hash. You may have different kinds of encrypted passwords in your database so this makes it clear.
- The actual encrypted password that is generated using your operating system’s crypt() function (MySQL calls it when you use the ENCRYPT SQL function) using…
- The new plaintext password (Roundcube replaces “%p” by it).
- “$5$” – that stands for using the SHA-256 algorithm. Check “man crypt” to see which algorithms are supported by crypt().
- And SUBSTRING(SHA(RAND()), -16) is used as a salt. A salt is just some additional randomness that makes it much much harder to reverse-engineer the actual password from the encrypted string.
- And of course we just want to change the password of the current email user. So “WHERE email=%u” makes sure we choose the right row in the database. Roundcube replaces “%u” with the user name – which is the same as the email address in our case.
(I used to recommend just using “dovecot pw -s SHA256-CRYPT” to generate passwords. You can do that, too. But in fact MySQL is capable of generating salted SHA256 hashes without calling any shell command. Thanks for the hint, Martin.)
Alright. Roundcube is now set up. But to be able to login and use it we need to install and configure Dovecot first. So don’t worry if the login does not work yet.
Trying it out
That was a lot of theory and configuration. Let’s finally try it. Go to https://YOUR.MAIL.SERVER/ and login as…
If everything works as intended you will be logged in and see…
If that didn’t work then check your /var/log/mail.log and /var/log/roundcube/errors files for errors.
Hello Christoph,
I tried to set up Roundcube to enable password change. I modified the config.inc.php file in the plugin/password directory with the following parameters :
$config[‘password_db_dsn’] = ”;
$config[‘password_query’] = ‘SELECT update_passwd(%D, %u)’;
$config[‘password_idn_ascii’] = false;
$config[‘password_dovecotpw’] = ‘/usr/sbin/dovecot’;
$config[‘password_dovecotpw_method’] = ‘SHA256-CRYPT’;
$config[‘password_dovecotpw_with_method’] = true;
It doesn’t work! The error message is :
“Could not save new password. Encryption function is missing”.
Any idea to solve this problem? Thanks in advance.
François
Hi Francois… I just realized that half of my article was accidentally not yet published. I just added the missing section. Please work through this page again and let me know if the password change now works correctly. Thanks.
Hi Christoph,
It appears there is a piece of the Roundcube configuration missing on this page. It starts by configuring the plugins, but doesn’t go in detail on how to select the server etc.
Thanks for your tutorial!
Hi Frederik. You could login when you first see the webmail interface. The server is just “localhost”. But if you proceed through this page until the very then you will indeed be able to login.
Hi Christoph, I seem to be missing the configuration step you did to disable the “server” input on the webmail interface in the tutorial. You also don’t explicitly mention the config file for Roundcube. Given the detail elsewhere, I wonder if there’s a piece of the tutorial I’m missing?
Now that you mention it – there was indeed a paragraph missing. This page is cursed. I must have made a stupid editing error and left out a part. It’s in there now. Look for “default_host”. And thanks for pointing that out.
Thank you so much! It works perfectly now.
Additionally users may not want the top level of their website to be the email – maybe add a note that the line
Alias / /var/lib/roundcube/
could be changed to alias it to some other directory, so the webmail would be available at https://server/webmail
Alias /webmail /var/lib/roundcube/
I encountered some problem; i got an 403 error. After some struggle i found out that;
Alias / /var/lib/roundcube
Should be
Alias / /var/lib/roundcube/
Note the ‘/’ at the end. 😉
Thanks, that was indeed a stupid typo. Fixed it.
Ran into the same problem. Thanks for the correction… Awesome Tutorial
It should probably be mentioned that if you want to use the password plugin in roundcube, you’ll need to grant UPDATE permissions to the mailuser. The mailuser is previously only granted select permissions to the mailserver database.
I wonder how that happened. After all I went through the guide twice to make sure it’s correct. Oh, my. Thanks for the hint. I have updated the page on database preparation.
for those of you wondering where the config file for roundcube is, its /etc/roundcube/config.inc.php
Thank you so much. There is nothing telling you to switch config files. I was flopping around trying to figure out why a totally different syntax would work in the virtualhosts file.
Connection to storage server failed.
denied (euid=5000(vmail) egid=5000(vmail) missing +w perm: /var/vmail, dir owned by 0:0 mode=0755)
Dear Christoph,
I’ve been following your wonderful tutorial(s) since I discovered it one year ago.
I am a complete noob – although I’ve been using linux for 5 years, it’s only a regular workstation and family use -. But as a hobby I tried to set up for my family.
So far, I’ve succeeded: my server is sending and receiving mails, I’ve not found any problems up to this point, but only one, changing passwords in Roundcube.
When I try to do it in Roundcube, the error is “Could not save new password. Encryption function missing”.
My /var/log/roundcube/errors reads:
“Error: Failed to load config from /var/lib/roundcube/plugins/jqueryui/config.inc.php in /usr/share/roundcube/program/lib/Roundcube/rcube_plugin.php on line 157 (GET /?_task=logout&_token=5d35e24217c5f425b2f4ff73ec1401b3)”,
and after following (I think I shouldn’t have done it) a commentary on a forum (something like this):
~# cd /var/lib/roundcube/plugins/jqueryui
Remove old link
~# rm config.inc.php
Create correct link
~# ln -s config.inc.php.dist config.inc.php
my /var/log/roundcube/errors reads:
“PHP Error: Failed to load config from /var/lib/roundcube/plugins/zipdownload/config.inc.php in /usr/share/roundcube/program/lib/Roundcube/rcube_plugin.php on line 157 (GET /?_task=mail&_remote=1&_unlock=0&_action=getunread&_=1446718738231) ”
Your help will be very much appreciated.
Now users can change their passwords, after:
$config[‘password_query’] = ‘UPDATE virtual_users SET password = ENCRYPT (%p, CONCAT(\’$6$\’, SUBSTRING(SHA(RAND()), -16))) WHERE email = %u’;
I’m not sure if the encryption method is the same – and if it is a suboptimal option – but it is working. Am I jeopardizing in any way the whole configuration?
Thank you so much.
Just an aside, Christoph. The last modification was taken from somewhere in the internet, just copy and paste. Is the only part I do not understand. I’ve learned a lot with your wonderful guide.
Thank you again.
Thanks for the hint. That’s indeed simpler than calling “dovecot pw”. I will add that.
Thank you Christoph for this very helpful tutorial.
One thing i got an issue is when trying to connect to roundcube while having php5-fpm enabled. I get this error:
“The requested URL /php5-fcgi/index.php was not found on this server.”
Do you have an idea of which configuration i should change ?
Thanks again !
Hi Nicolas. Glad to hear you like the tutorial. Incidentally I’m using nginx (I hate Apache actually) with php5-fpm. I know that fcgi is a bit different but perhaps my vhost snippet helps you:
server {
listen 443;
root /var/lib/roundcube;
index index.php;
server_name mail.workaround.org;
ssl on;
ssl_certificate /etc/ssl/certs/wildcard-workaround.org.pem;
ssl_certificate_key /etc/ssl/private/wildcard-workaround.org.key;
# Handle PHP files through FastCGI
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php5-fpm.sock;
}
}
Hello Christoph,
This is a great tutorial, I’ve started this tutorial in Jessie (I’m not migrating) and when i try to login to roundcube i get the following error message: “Connection to storage server failed.”
Hi Emiliane. Are you sure that Dovecot is listening on the IMAP port? Try “telnet localhost 143” on your mail server and see if you get a connection. Also check your /var/log/mail.log for hints.
I tried “telnet localhost 143″ and got the following: “telnet: Unable to connect to remote host: Connection refused”
I found out that dovecot is not running. I tried “service dovecot restart” but it won’t start.
I reviewed the dovecot configuration again and still the same issue
It was an issue with the 10-master.conf file.
10-master.conf
check imap login section
port = 143
Hi Christoph, thank you for the great guide!
I’m trying the installation on Ubuntu 15.10 server and for the moment everything should works.
Please pay attention that in case of error, roundcube logs everything under /var/log/roundcube/errors; IMHO this should be mentioned on your article because for a bad configuration I get a 500 error (nasty “Internal server error”) and nothing logged on apache’s log. This may be frustrating! 🙂 Only looking on this file lead me to the solution (my mistake of course! :-D)
Another point I’d like to discuss is about a configuration for subdomains: Actually I can access my roundcube at https://www.mydomain.com/roundcube/ but what if I’d like to access to https://roundcube.mydomain.com? Can you give us an hint?
Hi Francesco. Good hint. I will add that. regarding the path (“/roundcube” versus “/”): if you follow this page closely you will not have the /roundcube addition.
Hi Cristoph
I followed this wonderful tutorial step by step, because I am creating my first mail server.
When I try to access Roundcube through Iceweasel, this tells me DATABASE ERROR: CONNECTION FAILED! Unable to connect to the database!. Please contact your server-administrator.
I reviewed the files /etc/roundcube/config.inc.php and /etc/roundcube/debian-db.php and these are well.
The debian-db.php file has:
$dbuser=’roundcube’;
$dbpass=’my password’;
$basepath=’ ‘;
$dbname=’roundcube’;
$dbserver=’ ‘;
$dbport=’ ‘;
$dbtype=’mysql’;
¿how can i do to find a solution?
Very thanks
Hi Cristoph.
I found the solution to the problem :
Just edit the file /etc/roundcube/debian-db.php in the section $dbuser = ‘ roundcube ‘ ; and $dbpass= ‘my password’ ;, change the values of user and password by the values of the root user and password , try entering roundcube and it worked. Again edit the file /etc/roundcube/debian-db.php and return the values that had at first and went back to trying to enter rouncube and worked perfectly . I do not know what happened, but I imagine coming in with root, established the connection to the database that the user roudcube could not do .
Now on the other hand , when I try to access account john@example.org for testing, it shows me the message : ERROR CONNECTING TO IMAP SERVER.
I guess it’s a problem with dovecot , but do not know where to start.
I would much your help and guidance.
Greetings and thanks.
Hi Christoph,
this is a really good guide and now my Mail-Server ist working perfectly.
But I have one big problem: Over Roundcube every user can add identites with any adresses – e.g. root@gmail.com.
It’s funny but not very helpful on a productive System. Can you help me out how to disable this “feature”?
Hi. I’m really desperate . I need someone to help me solve my problem with roundcube and error : error in connection to the IMAP server , I searched everywhere on the configuration, but unfortunately I am new to the mail servers . I think the guide does not explain more about roundcube settings and where this should take the virtual databases . If someone already could perform this configuration, can you help me or direct me ?. Thank you.
Hi there,
all went smooth till here 🙂
But now I got this error:
mail dovecot: imap(john@example.org): Error: Failed to autocreate mailbox INBOX: Permission denied
Any idea?
Many thanks in advance
@david: chown -R vmail:vmail /var/vmail
Already owned by vmail 🙂
Others ideas?
I wonder a bit about the path “/var/vmail/example.org/john/mail/”. It’s supposed to be “/var/vmail/example.org/john/Maildir”. Did you change that on purpose? Or have you left a default setting in the Dovecot config where “Maildir” was supposed to be?
I really don’t know 😀 I followed your tutorial , i have this setting in 10-mail.conf:
mail_location = mbox:~/mail:INBOX=/var/mail/%d/%n/Maildir
Could it be somewhere else? and what about others directories? It’s strange…
Others directories ( Draft, Trash ) are created correctly :
ls /var/vmail/example.org/john/mail/ -lah
total 16K
drwx—— 3 vmail vmail 4,0K ene 5 14:40 .
drwx—— 3 vmail vmail 4,0K ene 5 14:38 ..
drwx—— 5 vmail vmail 4,0K ene 5 14:40 .imap
-rw——- 1 vmail vmail 0 ene 5 14:40 INBOX.Drafts
-rw——- 1 vmail vmail 0 ene 5 14:40 INBOX.Junk
-rw——- 1 vmail vmail 0 ene 5 14:40 INBOX.Trash
-rw——- 1 vmail vmail 36 ene 5 14:40 .subscriptions
Your mail_location looks wrong. See “Setting up Dovecot” again.
Yes sir! I just changed the %u for the %d/%n/Maildir , I didn’t realize the first part was different ( doing this stuff at 2:00 AM not a good moment probably… )
Many thanks!
chmod a+rwxt /var/mail worked for me
That’s an approach for people who open their front door with explosives instead of using the house key. Don’t do that. It’s evil on many levels.
Hello Christoph,
I have succesfully setup my mail server thanks to this guide.
I tried to change my password yesterday and i got an error message. When i check the roudcube error log i get the following.
DB Error: SQLSTATE[HY000] [1045] Access denied for user ”@’localhost’ (using password: NO) in /usr/share/roundcube/program/lib/Roundcube/rcube_db.php on line 178 (POST /?_task=settings&_action=plugin.password-save?_task=&_action=)
Hi Emiliano. Sounds like a problem with your $config[‘password_db_dsn’] setting.
I checked the configuration, i have
$config[‘password_db_dsn’] = ‘mysql://mailuser:MYPASSWORD@127.0.0.1/mailserver’;
but it seems like after mysql: is considering the rest of the line like a comment.
Hello Christoph,
My fresh server install did not have the php5 extension “mcrypt” enabled. Finally I decided to turn on the debugging in roundcube to get an error to show up explaining WHY I was unable to log in. Awesome tutorial by the way.
I had the same problem on Ubuntu. I enabled MCrypt with php5enmod mcrypt and then restarted apache.
Hi Christoph,
I followed yout tutorial to get my own mailserver.
Instead of using apache and MySQL I’m using nginx and PostgreSQL. In most cases it’s really no problem at all. You just have to replace “mysql” with “pgsql”. Of course you have to install the pgsql packages.
Well after some time I got to this page and here is the line which toke me three hours:
$config[‘password_query’] = “UPDATE virtual_users SET password=CONCAT(‘{SHA256-CRYPT}’, ENCRYPT (%p, CONCAT(‘$5$’, SUBSTRING(SHA(RAND()), -16)))) WHERE email=%u;”;
After a while I found the functions which should work with PostgreSQL but the “Crypt” function of PostgreSQL seems to work completely different from the “Encrypt” function of MySQL.
So I thought about changing the password plugin from Roundcube but luckily Roundcube delivers the solution out of the box.
Roundcube 1.2-beta:
$config[‘password_algorithm’] = ‘sha256-crypt’;
$config[‘password_algorithm_prefix’] = ‘{SHA256-CRYPT}’;
$config[‘password_query’] = “UPDATE virtual_users SET password=%P WHERE email=%u;”;
Roundcube 1.1.4
$config[‘password_query’] = “UPDATE virtual_users SET password=CONCAT(‘{SHA256-CRYPT}’, %c) WHERE email=%u;”;
$config[‘password_crypt_hash’] = ‘sha256’;
It works like a charm without that long sql query.
I don’t know which version is in the debian repositories though but I guess 1.1.4.
And another problem I had with Roundcube:
I added the header “X-Frame-Options DENY;” in my webserver configuration. Roundcube doesn’t work with it. So if anyone gets the same problem simply remove it.
Cheers
Great @Sushi!
I’m also using nginx/postgresql, but after changing my password I’ve got the weird errors, first the page got blank, I had to refresh it, then I got a “connection to storage server failed”.
After logout/login everything worked fine. I guess something related do $_SESSION vars didn’t work very well.
Is there any way to make the initial registration page different depending on the domain that has been entered ?. The system maintains virtual domains and could be interesting that each domain have a different registration page.
Is “Include /etc/roundcube/apache.conf” really needed in /etc/apache2/sites-available/default-ssl?
On the contrary we do need “Alias /phpmyadmin /usr/share/phpmyadmin” before “Alias / /var/lib/roundcube/”
First, thank you Christoph for your great ISP write-ups. I’ve used them for a number of years and have found them very helpful.
I’m stuck on a new setup. Instead of having my MySQL server on the same host as postfix/dovecot, I’m putting the databases on an Amazon AWS RDS MySQL database. For the most part this seems to have worked, except for the Roundcube sign-in. Both the main DB (known as mailserver in your write-up) and the Roundcube DB are set up as two databases on the Amazon RDS instance.
When trying to sign-in the Roundcube web screen with john@example.org, I get the following error message in /var/log/roundcubes/errors:
[10-Feb-2016 01:37:53 +0000]: IMAP Error: Login failed for john@example.org from xx.yy.zz.aa. Could not connect to db-mydomainname-email-us-east.cybvxu.us-east-1.rds.amazonaws.com:143: Connection timed out in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 197 (POST /roundcube/?_task=login?_task=login&_action=login)
Is this a Roundcube config problem, or possibly something with Dovecot?
Many thanks, Kevin
[solved] — I was making one change where I should not have been …
In /etc/roundcube/config.inc.php, I changed:
$config[‘default_host’] = ”;
to
$config[‘default_host’] = ‘db-mydomainname-email-us-east.cybvxu.us-east-1.rds.amazonaws.com’;
I was under the mistaken impression that this setting was related to the roundcube DB location, when in fact it is where roundcube expects to find the IMAP server.
So the correct setting for my setup is simply:
$config[‘default_host’] = ‘localhost’;
because my IMAP server is running on the same host as roundcube.
I use the Amazon AWS RDS database for the mailserver DB where all of the virtual tables are, and for the roundcube data.
When Roundcube is used by default it is possible to send emails supplanting another email account, to disable this option in the file “defaults.inc.php” I have changed “$ config [ ‘identities_level’] = 1;”
I hope this serves to you, and if anyone knows a safer way to prevent this from happening, you should post it here.
Is it possible for encrypting mail using tls in roundcube…?
Jeffry: use tls://domain.com as host.
Thanks for your manual, it works like a charm! But I have a tiny addition: Following your manual, I was not able to get the sieve “vacation manager” running. For this, you would have to edit the /etc/roundcube/plugins/managesieve/config.inc.php and set the following value: $config[‘managesieve_vacation’] = 1;
This will give you the possibility to manage the special vacation message in Einstellungen/Urlaub or Settings/Vacation.
I’ve switched from Ubuntu to Debian and followed this guide but I can’t log into Roundcube with the user john@example.org. I think I’ve lost track of which password goes where. I’m dyslexic so it has been difficult to follow. I was getting “access denied for user ‘mailuser’@’localhost’ but I think I fixed it as I am now getting no errors in mail.log but still Roundcube says “Connection to storage server failed”. Any ideas?
I’ve sorted it. I’d pasted something into a wrong file. Now I just need to get the forwarder working. Thanks for the guide.
Dear Christoph,
thank you for providing this excellent guide with all the good explanations, that makes learning fun!
I was able to follow all the examples and also to perform the checks you explained, but got stuck on the “Roundcube” page.
I am wondering if there is still something missing on the “Roundcube setup” page…
After following all the instructions and trying to log in as “john@example.org” with pw summmersun,
the login page shows the error”Connection to storage server failed”.
Thr roundcube error log is mumbling something like ”
Failed to load config from /var/lib/roundcube/plugins/jqueryui/config.inc.php in /usr/share/roundcube/program/lib/Roundcube/rcube_plugin.php on line 157 (GET /),”
From the comments above I see that other users also faced this problem, there is also a comment about queryui…
but unfortunately there is no hint how these problems were resolved.
Also you state on the Roundcube page that Dovecot still needs to be setup,
but that was done already way earlier, but then in the next sentence comes already “Trying it out”.
That looks like something is missing or still messed up on this specific page.
I saw a statement from you that a paragraph was missing and that this specific page is cursed… perhaps the curse is still working 🙂
Anyway, I already learned a lot and am looking forward to get the setup complete.
Thank you very much for all the effort you put into this instruction set.
Peter
Hi Christoph,
after reviewing all config files one more time there was a copy and paste error in /etc/dovecot/dovecot-sql.conf.ext.
All the tests are working correctly now, I will continue the setup.
Thank you again!
Peter
I am getting the following error when I try and log from roundcube in mail.log:
dovecot: imap-login: Disconnected (tried to use disallowed plaintext auth): user=, rip=127.0.0.1, lip=127.0.1.1,
round cube web interface gives me Connection to storage server failed.
any ideas?
Hello Christoph,
Thanks for your new tutorial!
About two years ago, I followed your wheezy tutorial for my current mail servers, and they have worked well until today. When upgrading to jessie, I learned that Apache2 (httpd 2.4) has become way more restrictive, in that .htaccess files are disregarded by default and web contents must reside either under /var/www or /usr/share. (s. /etc/apache2/apache2.conf)
When reading your roundcube setup, I wondered how
Alias / /var/lib/roundcube/
could ever work without previously modifying /etc/apache2/apache2.conf. Also do I expect the .htaccess file in /usr/share/roundcube or /var/lib/roundcube to be ignored by apache2. Am I missing something?
Ah, I see: Including /etc/roundcube/apache.conf” makes Apache2 read the .htaccess files.
Still wondering about the “forbidden” directories.
Okay, I have tested it. For me it works by just saying
a2enconf roundcube.conf
and
Alias /roundcube /var/lib/roundcube/
somewhere in the apache configs.
Sorry for littering this blog.
Thank you, it works very well!
But the file /etc/roundcube/plugins/password/config.inc.php contains the mailuser password. By default, it seems that everybody has read access to this file. A “chmod go-r” on the file should solve this problem.
For information, I tried adding at the end of /etc/roundcube/config.inc.php the following line:
$config[‘username_domain’] = ‘example.com’;
After a ‘service apache2 reload’, I could use login ‘username’ instead of ‘username@example.com’ for roundcube.
I think it’s better to change the file access right to “/etc/roundcube/plugins/password/config.inc.php”, because there’s password in this file as “$config[‘password_db_dsn’] = ‘mysql://mailuser:ChangeMe@127.0.0.1/mailserver’;”.
Hello to All,
maybe someone can help me. I tried to Setup the Mailserver with this Tutorials but I can’t Login to the roundcube webmailer. “connection failed to the storage Server” and in the mail.error log I get ” user admin@XXXXXXX: Mail access for users with UID 120 not permitted (see first_valid_uid in config file, uid from userdb lookup).
This page seems to have the “missing paragraph” errors.
I had some issues with the roundcube password plugin. I am using Jessie 8.5, roundcube 1.1.5 from backports, and apache 2.4. Some of these changes are probably Debian specific and related to how Roundcube is packaged for Debian.
I kept the 10 character password and resave options, but I had to make a few changes to get this to work for me.
# these make the password conf file private, but readable by apache
1) chmod 640 /etc/roundcube/plugins/password/config.inc.php
2) chgrp www-data /etc/roundcube/plugins/password/config.inc.php
3) I commented out the $config[‘password_db_dsn’] in /etc/roundcube/plugins/password/config.inc.php. By default, it will use the Roundcube DB settings, which are set in /etc/roundcube/plugins/debian-db.php. This isn’t 100% necessary, but for some reason, the config is not parsed correctly and the //…blah is parsed as a comment. They can be escaped, but my php-fu is weak. It would work, but I get division by zero warnings. in /var/log/roundcube/errors.
4) In /etc/roundcube/plugins/password/config.inc.php, I had to explicitly state the the database to use (mailserver.virtual_users) since the Roundcube Debian defaults are to use the roundcube database.
$config[‘password_query’] = “UPDATE mailserver.virtual_users SET password=CONCAT(‘{SHA256-CRYPT}’, ENCRYPT (%p, CONCAT(‘$5$’, SUBSTRING(SHA(RAND()), -16))))$.
5) I had to grant select and update privileges to the roundcube user in MYSQL.
GRANT SELECT,UPDATE ON mailserver.* TO ’roundcube’@’localhost’ IDENTIFIED BY ‘some_password’;
6) I had to change some of the owners/groups/permissions in /etc.roundcube. These are similar to #1 and #2 above and let apache read the config files.
7) I’m not sure if this makes a difference in /etc/roundcube/plugins/password/config.inc.php?
$config[‘password_crypt_hash’] = ‘sha256’;
$config[‘password_dovecotpw_method’] = ‘SHA256-CRYPT’;
$config[‘password_dovecotpw_with_method’] = true;
8) This might be Debian specific, but the Roundcube password is set in “two” places- 1) /etc/dbconfig-common/roundcube.conf and 2) /etc/roundcube/debian-db.conf. The first will probably set the password if you run dpkg-reconfigure and overwrite the second.
Thanks for an amazing guide- I have used this since Wheezy and appreciate the level of detail that is in here.
Hello to all,
Connection to storage server failed in Roundcube Webmail Login problem.
Please need to help how i am solve this problem.
Thanks,
Jahanggir-BD
Perhaps a couple additional typos on the “Setting up Roundcube webmail” page:
I presume the first line after the “Virtual host for HTTPS” heading should include the “.conf” filename end: “Edit the file /etc/apache2/sites-available/default-ssl.conf”.
With apache2 2.4.10 I don’t see an “[ok]” message when reloading the service, but all seems to work at this point.
In the “Set up HTTP to HTTPS redirection” section, I don’t have a /etc/apache2/sites-available/default file, but only the 000-default.conf and default-ssl.conf files.
And neither my 000-default.conf file nor default-ssl.conf file has a list of plugins section that Roundcube loads. Perhaps I have an earlier error just now apparent?
Are there samples of what these two .conf files should look like?
I, with many others, a truly grateful for your great tutorial!
Hi guys, can anyone help me with this error:
Connection refused in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 197 (POST /?_task=login?_task=login&_action=login)
Thanks in Advance
Hi,
my domain is: @ces.uc.pt and when a logged apears @mail.ces.uc.pt
And the imap is correct because a have my emails from@ces.uc.pt in the box but in the top appears @mail.ces.uc.pt
Can anyone help me please?
Thanks
Hi,
how can I check the date and time of last change of password in round cube.
can anyone help me please?
Thank you
In /etc/roundcube/config.inc.php
// List of active plugins (in plugins/ directory)
$config[‘plugins’] = array(
‘archive’,
‘zipdownload’,
‘managesieve’,
‘password’,
);
and in /etc/roundcube/plugins/password/config.inc.php
$config[‘password_log’] = true;
Thank you for this great write up! I was able to get most of this done, but from what I have read above with password changes in Roundcube, I am still not able to get this function / plugin to work.
The SQL being used is just like in the write up :
$config[‘password_query’] = “UPDATE virtual_users SET password=CONCAT(‘{SHA256-CRYPT}’, ENCRYPT (%p, CONCAT(‘$5$’, SUBSTRING(SHA(RAND()), -16)))) WHERE user_id=%n;”;
The connction into the DB is:
$config[‘password_db_dsn’] = ‘mysql://mailuser:mysecret@127.0.0.1/mailserver’;
I get no errors in the error log about the issue but I have that turned on as true. Really beating myself up on this issue since I really need my users to be able to change their passwords. I have the Database setup just as the write states.
All I get when I try a test user to change the password is:
“An Error Occured”
“Cannot Save New Password”
I am using Centos 6 MySQL…. I have no idea why this is not working. I followed this exactly as it is written up.
Any help would be greatly appreciated. Thanks.
Update on this… I was able to figure out this issue… I had to install the mhash rpm.
yum install mhash
This was a painful step not knowing I had to have this… I finally figured this out by reading this:
Root cause: Since CentOS 6 doesn’t have PHP mhash module, it cannot generate password in SSHA format.
(That was in 2011 for Centos 6, but since Centos 6 has been around a bit of time, mhash was avaialble and finally installed this and that was the missing link to get the password plugin to get the password changed for my users.
Reference from above info:
http://www.iredmail.org/forum/topic2751-iredmail-support-roundcube-webmail-can-not-change-password-in-centos6.html
Hello, and big thanks for this tutorial..
everything went good so far except the point: TRY IT OUT 😛
as soon as i try to login i get the following error message: “Connection to storage server failed.”
Yes i tried the telnet connection 143:
telnet 127.0.0.1 143
Trying 127.0.0.1…
Connected to 127.0.0.1.
Escape character is ‘^]’.
Connection closed by foreign host.
the mail log reads:
Mar 12 23:46:00 server13 dovecot: master: Warning: Killed with signal 15 (by pid=4531 uid=0 code=kill)
Mar 12 23:46:01 server13 dovecot: master: Dovecot v2.3.0.alpha0 (a8d3f2d) [XI:2:2.3.0~alpha0-1~auto+733] starting up for imap, lmtp, sieve, pop3 (core dumps disabled)
Mar 13 00:10:07 server13 dovecot: imap-login: Fatal: Couldn’t parse DH parameters: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: DH PARAMETERS
Mar 13 00:10:07 server13 dovecot: master: Error: service(imap-login): command startup failed, throttling for 2 secs
Mar 13 00:17:48 server13 dovecot: imap-login: Fatal: Couldn’t parse DH parameters: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: DH PARAMETERS
Mar 13 00:17:48 server13 dovecot: master: Error: service(imap-login): command startup failed, throttling for 4 secs
Mar 13 00:18:07 server13 dovecot: imap-login: Fatal: Couldn’t parse DH parameters: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: DH PARAMETERS
Mar 13 00:18:07 server13 dovecot: master: Error: service(imap-login): command startup failed, throttling for 8 secs
Mar 13 00:21:42 server13 dovecot: master: Warning: SIGHUP received – reloading configuration
Mar 13 00:21:57 server13 dovecot: imap-login: Fatal: Couldn’t parse DH parameters: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: DH PARAMETERS
Mar 13 00:21:57 server13 dovecot: master: Error: service(imap-login): command startup failed, throttling for 2 secs
Mar 13 00:22:11 server13 dovecot: imap-login: Fatal: Couldn’t parse DH parameters: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: DH PARAMETERS
Mar 13 00:22:11 server13 dovecot: master: Error: service(imap-login): command startup failed, throttling for 4 secs
Mar 13 00:34:14 server13 spamass-milter[825]: spamass-milter 0.3.2 starting
Mar 13 00:34:14 server13 dovecot: master: Dovecot v2.3.0.alpha0 (a8d3f2d) [XI:2:2.3.0~alpha0-1~auto+733] starting up for imap, lmtp, sieve, pop3 (core dumps disabled)
Mar 13 00:34:28 server13 postfix/master[1629]: daemon started — version 2.11.3, configuration /etc/postfix
Mar 13 00:35:42 server13 dovecot: imap-login: Fatal: Couldn’t parse DH parameters: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: DH PARAMETERS
Mar 13 00:35:42 server13 dovecot: master: Error: service(imap-login): command startup failed, throttling for 2 secs
Maybe you can give me a hint?
Thanks!
As already noted by Darrell on 2016-07-18 at 22:37 there is a typo in “Edit the /etc/apache2/sites-available/default file”. The file name should be 000-default.conf
“Further down there is a list of plugins that Roundcube loads” would be clearer as “Further down in /etc/roundcube/config.inc.php there is a list of plugins that Roundcube loads”
Thanks. I must have missed Darrell’s hint. The text should be fixed now.
Regards testing Roundcube “If that didn’t work then check your /var/log/mail.log for errors”.
A typo in /etc/roundcube/plugins/password/config.inc.php did not generate a message in /var/log/mail.log; it generated a message in /var/log/roundcube/errors
I’ve been trying to get this working for the last few hours, but I am not using apache so I am at a loss, I am using nginx instead. I couldn’t figure out how to alias the roundcube directory in the site config (or rather, get it working), so I downloaded roundcube from their website and extracted it directly to a directory of it’s own in /var/www/main (the root folder of my domain), how can I configure roundcube to get it working?
I got the following in my config.inc.php:
$config[‘db_dsnw’] = ‘mysql://mailuser:MYPASSHERE@127.0.0.1/mailserver’;
The /installer will not work presumably because I made a copy of the config dist myself and set it up. However when going to roundcube in a browser I get:
DATABASE ERROR: CONNECTION FAILED!
Unable to connect to the database!
Appreciate any help in advance.
Ok I played stupid big time… I didn’t import the mysql.initial.sql file, however as best as I recall no step I went through in this guide told me I had to do this, and I didn’t see it be done automatically. I got the login working now.
Hi, great tutorial, already built 2 servers basing on it. I can’t make it work downloading all attachments to single zip file in Roundcube. What I found out is that zipdownload requires php-zip extension which is not available for Debian Jessie. I used php-pclzip but it’s not working. Anyone was successful to in this matter?
Best
I have been using the tutorial to do email setup but on Debian Jessie. Recently I tested out using ubuntu 14.04. The roundcube installation through Ubuntu repository, and the config file is main.inc.php and there is a need to include extension=mcrypt.so in /etc/php5/apache/php.ini (even though php5-mcrypt module is installed). If not Roundcube will give an error 500 Service Not Available
Hi All
I hope you are well. Many thanks for the job. Now I have my personal mail server!!!
I have an issue with Roundcube about auto-completion when I write an email.
I install the plugin “automatic-addressbook”, that is good for record new users but auto-completion don’t work…
Thank you for your help and sorry for my bad English (I’m french)
Fred