Skip to main content

RoundCube with IndiMail


These instructions will work on CentOS, RHEL, Fedora. For Debian/Ubuntu and other distros, please use your knowledge to make changes accordingly. In this guide, replace indimail.org with your own hostname.

Non SSL Version Install/Configuration

(look below for SSL config)
  1. Install RoundCube. On older systems, use the yum command
$ sudo dnf -y install roundcubemail php-mysqlnd



  1. Connect to MySQL using a privileged user. IndiMail installation creates a privileged mysql user 'mysql'. It does not have the user 'root'. Look at the variable PRIV_PASS in /usr/sbin/svctool to know the password.
$ /usr/bin/mysql -u mysql -p mysql
MySQL> create database RoundCube_db;
MySQL> create user roundcube identified by 'subscribed';
MySQL> GRANT ALL PRIVILEGES on RoundCube_db.* to roundcube;
MySQL> FLUSH PRIVILEGES;
MySQL> QUIT;
$ /usr/bin/mysql -u mysql -p RoundCube_db < /usr/share/roundcubemail/SQL/mysql.initial.sql



  1. Copy /etc/roundcube/config.inc.php.sample to /etc/roundcube.inc.php
$ sudo cp /etc/roundcube/config.inc.php.sample /etc/roundcubemail/config.inc.php



Edit the lines in /etc/roundcube/config.inc.php
$config['db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';
$config['smtp_server'] = 'localhost';
$config['smtp_port'] = 587;
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['support_url'] = 'http://indimail.sourceforge.net';
$config['product_name'] = 'IndiMail Webmail';
$config['plugins'] = array(
'archive',
'sauserprefs',
'markasjunk2',
'iwebadmin',
);
NOTE: the iwebadmin plugin will not work for postmaster account or IndiMail users having QA_ADMIN privileges. man vmoduser(1)
This file should have read permission for apache group
$ sudo chown root:apache /etc/roundcube/config.inc.php
$ sudo chmod 640 /etc/roundcube/config.inc.php



For markasjunk2 to work you need to set permission for apache to write /etc/indimail/spamignore
$ sudo chown apache:indimail /etc/indimail/spamignore
$ sudo chmod 644 /etc/indimail/spamignore


  1. Edit the lines in /etc/roundcube/defaults.inc.php
$config['db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';$config['imap_auth_type'] = 'LOGIN';
$config['smtp_auth_type'] = 'LOGIN';
This file should have read permission for apache group
$ sudo chown root:apache /etc/roundcube/defaults.inc.php
$ sudo chmod 640 /etc/roundcube/defaults.inc.php



  1. Change iwebadmin path in /usr/share/roundcubemail/iwebadmin/config.inc.php
$rcmail_config['iwebadmin_path'] = 'http://127.0.0.1/cgi-bin/iwebadmin';



  1. Change sauserprefs_db_dsnw in /usr/share/roundcubemail/sauserprefs/config.inc.php
$rcmail_config['sauserprefs_db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';



  1. Restore indimail plugins for roundcube

$ sudo yum install ircube


or
$ cd /tmp
$ wget http://downloads.sourceforge.net/indimail/indimail-roundcube-1.0.tar.gz # This file
$ cd /
$ sudo tar xvfz /tmp/indimail-roundcube-1.0.tar.gz usr/share/roundcubemail/plugins
$ /usr/bin/mysql -u mysql -p RoundCube_db < /usr/share/roundcubemail/sauserprefs/sauserprefs.sql



  1. change pdo_mysql.default_socket /etc/php.ini
For some reason pdo_mysql uses wrong mysql socket on some systems. Uses /var/lib/mysql/mysql.sock instead of /var/run/mysqld/mysqld.sock. You need to edit the file /etc/php.ini and define pdo_mysql.default_socket
pdo_mysql.default_socket= /var/run/mysqld/mysqld.sock


You can verify if the path has been correctly entered by executing the below command. The command should return without any error
$ php -r "new PDO('mysql:host=localhost;dbname=RoundCube_db', 'roundcube', 'subscribed');"



  1. HTTPD config
    1. Edit file /etc/httpd/conf.d/roundcubemail.conf and edit the following lines
#
# Round Cube Webmail is a browser-based multilingual IMAP client
#Alias /indimail /usr/share/roundcubemail
# Define who can access the Webmail
# You can enlarge permissions once configured
# Apache 2.4
Require ip 127.0.0.1
Require all granted
Require local
# Apache 2.2
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from ::1


This file should be owned by root
$ sudo chown root:root /etc/httpd/conf.d/roundcubemail.conf
$ sudo chmod 644 /etc/httpd/conf.d/roundcubemail.conf


    1. Restart httpd

$ sudo service httpd restart



  1. Login to webmail at http://localhost/indimail

SSL / TLS Version




  1. Install RoundCube. On older systems, use the yum command
$ sudo dnf -y install roundcubemail php-mysqlnd



  1. Connect to MySQL using a privileged user. IndiMail installation creates a privileged mysql user 'mysql'. It does not have the user 'root'. Look at the variable PRIV_PASS in /usr/sbin/svctool to know the password.
$ /usr/bin/mysql -u mysql -p mysql
MySQL> create database RoundCube_db;
MySQL> create user roundcube identified by 'subscribed';
MySQL> GRANT ALL PRIVILEGES on RoundCube_db.* to roundcube;
MySQL> FLUSH PRIVILEGES;
MySQL> QUIT;
$ /usr/bin/mysql -u mysql -p RoundCube_db < /usr/share/roundcubemail/SQL/mysql.initial.sql



  1. Copy /etc/roundcube/config.inc.php.sample to /etc/roundcube.inc.php

$ sudo cp /etc/roundcube/config.inc.php.sample /etc/roundcubemail/config.inc.php


Edit the lines in /etc/roundcube/config.inc.php
$config['db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';
$config['default_host'] = 'ssl://indimail.org';
$config['smtp_server'] = 'localhost';
$config['smtp_port'] = 587;
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['support_url'] = 'http://indimail.sourceforge.net';
$config['product_name'] = 'IndiMail Webmail';
$config['plugins'] = array(
'archive',
'sauserprefs',
'markasjunk2',
'iwebadmin',
);
NOTE: the iwebadmin plugin will not work for postmaster account or IndiMail users having QA_ADMIN privileges. man vmoduser(1)
This file should have read permissions for apache group
$ sudo chown root:apache /etc/roundcube/config.inc.php
$ sudo chmod 640 /etc/roundcube/config.inc.php



  1. Edit the lines in /etc/roundcube/defaults.inc.php i.e.
$config['db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';
$config['default_host'] = 'ssl://indimail.org';
$config['default_port'] = 993;
$config['imap_conn_options'] = array(
'ssl' => array(
'verify_peer' => false,
'verify_peer_name' => false,
),
);
$config['imap_auth_type'] = 'LOGIN';
$config['smtp_auth_type'] = 'LOGIN';
$config['force_https'] = true;
$config['product_name'] = 'IndiMail Webmail';
$config['useragent'] = 'IndiMail Webmail/'.RCMAIL_VERSION;


This file should have read permission for apache group$config['force_https'] = true;
$ sudo chown root:apache /etc/roundcube/defaults.inc.php
$ sudo chmod 640 /etc/roundcube/defaults.inc.php


  1. Change iwebadmin path in /usr/share/roundcubemail/iwebadmin/config.inc.php
$rcmail_config['iwebadmin_path'] = 'https://127.0.0.1/cgi-bin/iwebadmin';
  1. Change sauserprefs_db_dsnw in /usr/share/roundcubemail/sauserprefs/config.inc.php
$rcmail_config['sauserprefs_db_dsnw'] = 'mysql://roundcube:subscribed@localhost/RoundCube_db';
  1. Restore indimail plugins for roundcube
$ cd /tmp
$ wget http://downloads.sourceforge.net/indimail/indimail-roundcube-ssl-1.0.tar.gz # This file
$ cd /
$ sudo tar xvfz /tmp/indimail-roundcube-ssl-1.0.tar.gz usr/share/roundcubemail/plugins
$ /usr/bin/mysql -u mysql -p RoundCube_db < /usr/share/roundcubemail/sauserprefs/sauserprefs.sql



  1. Change pdo_mysql.default_socket /etc/php.ini
For some reason pdo_mysql uses wrong mysql socket on some systems. Uses /var/lib/mysql/mysql.sock instead of /var/run/mysqld/mysqld.sock. You need to edit the file /etc/php.ini and define pdo_mysql.default_socket
pdo_mysql.default_socket= /var/run/mysqld/mysqld.sock



You can verifiy if the path has been correctly entered by executing the below command. The command should return without any error
php -r "new PDO('mysql:host=localhost;dbname=RoundCube_db', 'roundcube', 'subscribed');"



  1. HTTPD config
    1. Edit file /etc/httpd/conf.d/roundcubemail.conf and edit the following lines
#
# Round Cube Webmail is a browser-based multilingual IMAP client
#Alias /indimail /usr/share/roundcubemail
# Define who can access the Webmail
# You can enlarge permissions once configured
# Apache 2.4
Require ip 127.0.0.1
Require all granted
Require local
# Apache 2.2
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from ::1


This file should be owned by root
$ sudo chown root:root /etc/httpd/conf.d/roundcubemail.conf
$ sudo chmod 644 /etc/httpd/conf.d/roundcubemail.conf


    1. This is assuming you have already generated indimail cert after indimail installation. If not execute the following command. We will assume that your host is indimail.org
$ sudo /usr/sbin/svctool --postmaster=postmaster@indimail.org –config=cert"
--common_name=indimail.org
Edit the file /etc/httpd/conf.d/ssl.conf i.e.
ServerName indimail.org:443
SSLCertificateFile /etc/indimail/certs/servercert.pem


Now apache server needs access to servercert.pem. Add apache user to the qmail group. You can chose either of the below two options (Options 2 is less secure, as it gives httpd access to qmail files).
Option 1
$ sudo chown indimail:apache /etc/indimail/certs/servercert.pem
$ sudo chmod 640 /etc/indimail/certs/servercert.pem


Option 2
$ sudo usermod -aG qmail apache


Now you should see apache getting qmail group access
$ grep "qmail:x:" /etc/group
qmail:x:1002:qscand,apache


    1. Edit file /etc/php.ini. For some funny reason, the cert needs to be mentioned. i.e.
openssl.cafile=/etc/indimail/certs/servercert.pem
openssl.capath=/etc/pki/tls/certs
        Run the following command to get the cert locations. [ini_cafile] should point to servercert.pem location.
$ php -r "print_r(openssl_get_cert_locations());"
Array
(
[default_cert_file] => /etc/pki/tls/cert.pem
[default_cert_file_env] => SSL_CERT_FILE
[default_cert_dir] => /etc/pki/tls/certs
[default_cert_dir_env] => SSL_CERT_DIR
[default_private_dir] => /etc/pki/tls/private
[default_default_cert_area] => /etc/pki/tls
[ini_cafile] => /etc/indimail/certs/servercert.pem
[ini_capath] => /etc/pki/tls/certs
)


    1. Follow instructions to setup https
https://wiki.centos.org/HowTos/Https


    1. Restart httpd

$ sudo service httpd restart


    1. It appears that in PHP 5.6.0, functions are now validating SSL certificates(in a variety of ways). First, it appears to fail for untrusted certificates (i.e. no matching CA trusted locally), and secondly, it appears to fail for mismatched hostnames in the request and certificate. Verify that php is using the correct certificate with proper CN. Use the program testssl.php download from the location you downloaded this README/INSTALL file. In Step 9ii you created a certificate with common_name as indimail.org. Use the same host that you gave when creating the certificate.

$ php ./testssl.php indimail.org
Success



  1. Login to webmail
    1. edit /etc/hosts and edit the line for localhost i.e.
127.0.0.1 localhost indimail.org
    1. Restart httpd
$ sudo service httpd restart
    1. Login to webmail at https://indimail.org/indimail
      NOTE: Replace indimail.org with domain that you have configured
Post a Comment

Popular posts from this blog

IndiMail Installation for newbies in < 10 steps

Installing Indimail using YUM/APT Repository Install OS
OpenSUSE
openSUSE Leap 42.3
openSUSE Leap 42.2
openSUSE 13.2
openSUSE 13.1
SUSE Linux Enterprise 12 SP2
SUSE Linux Enterprise 12 SP1
SUSE Linux Enterprise 12
Red Hat
Feodra 27
Fedora 26
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 6
CentOS 7
CentOS 6
Debian
Debian 8.0
Debian 7.0
Ubuntu 17.04
Ubuntu 16.10
Ubuntu 16.04
Ubuntu 14.04
Ubuntu 12.04
Click the below URL for Install Instructions
https://software.opensuse.org/download.html?project=home%3Aindimail&package=indimail Shutdown MySQL if already running and disable MySQL from being started up by the system % /etc/init.d/mysqld stop % sudo chkconfig mysqld off % /bin/rm -f /service/mysql.3306/down
Start IndiMail
% sudo service indimail start Check Servicess
% sudo /usr/bin/svstat /service/* /service/clamd: up (pid 1014) 2985 seconds /service/dnscache: up (pid 1021) 2985 seconds /service/fetchmail: down 2985 seconds /service/freshclam: up (pid 1020) 2…

The AdminClient Protocol

IndiMail provides close to around 300 different programs as part of a flexible Enterprise Messaging Platform. You can carry administer the entire platform with around 45 of these programs. A program called indisrvr(8) provides a way for users to secure execute these commands from any remote location. To execute these programs, you need to have an admin account on the IndiMail server. These accounts can be created by the mgmtpass(8) program. Once you have an admin account on the IndiMail server, you can further restrict users to certain programs using the vpriv(8) program. vpriv can further modify privileges by allowing only certain options within a allowed program.

To execute these programs on the IndiMail server, you need to connect to port 4000 and use the adminclient protocol. The adminclient protocol is described below by showing a conversation between a client and the server 'indisrvr'


s - denotes server
c - denotes client

        s: "Login: "
        c: "u…

Writing Filters for IndiMail

IndiMail provides multiple methods by which you can intercept an email in transit and modify the email headers or the email body. A filter is a simple program that expects the raw email on standard input and outputs the message text back on standard output. The program /bin/cat can be used as a filter which simply copies the standard input to standard output without modifying anything. Some methods can be used before the mail gets queued and some methods can be used before the execution of local / remote delivery.

It is not necessary for a filter to modify the email. You can have a filter just to extract the headers or body and use that information for some purpose. IndiMail also provides the following programs - 822addr(1), 822headerfilter(1), 822bodyfilter(1), 822field(1), 822fields(1), 822header(1), 822body(1), 822headerok(1), 822received(1), 822date(1), 822fields(1) to help in processing emails.

Let us say that we have written a script /usr/local/bin/myfilter. The myfilter program …